CVE-2026-34838 — AI Deep Analysis Summary

🚨 **Essence**: Group Office suffers from **Unsafe Deserialization** in the `AbstractSettingsCollection` model.…

🛡️ **Root Cause**: **CWE-502** (Deserialization of Untrusted Data).…

📦 **Affected Versions**: - Group Office **6.8.156** and earlier - Group Office **25.0.90** and earlier - Group Office **26.0.12** and earlier 🏢 **Vendor**: Intermesh (Group Office).

💀 **Attacker Capabilities**: - **Remote Code Execution (RCE)**: Run arbitrary commands on the server. - **Arbitrary File Write**: Modify or create files on the filesystem. - **Full System Compromise**: High impact on Co…

🔐 **Exploitation Threshold**: **Medium**. The CVSS vector `PR:L` indicates **Privileges Required**. An attacker likely needs **authenticated access** to the Group Office application to trigger the deserialization flaw.…

🕵️ **Public Exploit Status**: **No**. The `pocs` field is empty. While GitHub advisories exist, there are no confirmed public Proof-of-Concept (PoC) exploits or widespread wild exploitation reported yet.

🔍 **Self-Check Method**: 1. Check your Group Office version against the affected list. 2. Scan for the `AbstractSettingsCollection` class usage in custom modules. 3.…

✅ **Official Fix**: **Yes**. Patches are available in the following releases: - v6.8.156 - v25.0.90 - v26.0.12 🔗 **Reference**: [GitHub Advisory GHSA-h22j-frrf-5vxq](https://github.com/Intermesh/groupoffice/security/advi…

🚧 **No Patch Workaround**: 1. **Restrict Access**: Limit network access to Group Office to trusted IPs only. 2.…

⚡ **Urgency**: **HIGH**. Despite requiring authentication, the impact is **Critical** (RCE + File Write). CVSS score is high (`H` for all metrics).…