NVD Lists CVE-2026-62076 as Critical Unauthenticated Flaw in Kalles CMS

The National Vulnerability Database has published a new record for CVE-2026-62076, rating it as critical. This entry highlights a security weakness in Kalles CMS that could allow attackers to compromise systems without credentials. Security teams should assess their exposure immediately.

In plain English

This issue involves a flaw in how Kalles CMS handles data. An attacker can send specially crafted input to the server. The application processes this input as a PHP object. This allows the attacker to execute commands on the server. No login or password is required to exploit this.

The risk is severe because the flaw requires zero authentication. Attackers can target any public-facing instance of the software. They do not need to guess passwords or steal cookies. The vulnerability exists in the core processing logic of the application.

The background

The National Vulnerability Database records this issue under CVE-2026-62076. It assigns a Common Vulnerability Scoring System score of 9.8. This is the highest possible rating for a vulnerability. The score reflects the ease of exploitation and the impact.

The weakness is classified as CWE-502. This category covers insecure deserialization of untrusted data. The flaw affects Kalles CMS versions up to and including 1.1.7.1. Any installation running these versions is vulnerable.

What changes now

Organisations using Kalles CMS must verify their version numbers. If they are running 1.1.7.1 or older, they are at risk. The NVD record confirms the severity but does not detail a specific patch. Users should monitor vendor communications for updates.

Security operations teams need to scan their infrastructure. They should identify all instances of Kalles CMS. Prioritise remediation for systems exposed to the internet. Internal networks may also face risk if lateral movement occurs.

What to do and how to stay safe: Kalles CMS

• Scan your web applications to identify any installations of Kalles CMS version 1.1.7.1 or earlier.
• Restrict network access to these systems using firewalls until a vendor update is available.
• Monitor web server logs for unusual POST requests or large data payloads targeting the application.
• Review application logs for signs of unauthorized code execution or unexpected process creation.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-62076?

The NVD rates CVE-2026-62076 with a CVSS score of 9.8, which is considered critical.

Which versions of Kalles CMS are affected by this vulnerability?

The vulnerability affects The4 Kalles up to version 1.1.7.1, including all earlier releases.

Does this flaw require user authentication to exploit?

No, the source material describes this as an unauthenticated PHP object injection flaw.