CVE-2018-20732

CRITICAL

SAS Web Infrastructure Platform < 9.4 - Insecure Deserialization

Title source: rule

SAS Web Infrastructure Platform before 9.4M6 allows remote attackers to execute arbitrary code via a Java deserialization variant.

CVSS v3 9.8

EPSS 0.0320

EPSS Percentile 86.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-502

Status published

sas/web_infrastructure_platform < 9.4

sas/web_infrastructure_platform

Published Jan 17, 2019

Tracked Since Feb 18, 2026