EIP-2026-102348

This advisory describes a remote code execution vulnerability in PowerFolder Server 10.4.321 due to unsafe deserialization of Java objects. The exploit leverages a modified Apache Commons library, bypassing removed dangerous classes to achieve RCE via a gadget chain.