{"vulnerability": "CVE-2021-26914", "sightings": [{"uuid": "5df100aa-2131-4a0a-a14d-aad71b187c2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26914", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "7aed7257-0f52-4365-a5a8-b1edf3e2ccd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26914", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:36.000000Z"}, {"uuid": "edf0d25d-4801-44e9-8677-bca7b359af4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26914", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/netmotion_mobility_mvcutil_deserialization.rb", "content": "", "creation_timestamp": "2021-05-17T19:53:59.000000Z"}, {"uuid": "22301cf2-059b-4503-9954-4cae09cee714", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26914", "type": "seen", "source": "https://t.me/arpsyndicate/2613", "content": "#ExploitObserverAlert\n\nCVE-2021-26914\n\nDESCRIPTION: Exploit Observer has 7 entries related to CVE-2021-26914. NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in MvcUtil valueStringToObject.\n\nFIRST-EPSS: 0.634780000\nNVD-IS: 5.9\nNVD-ES: 2.2", "creation_timestamp": "2024-01-07T05:08:20.000000Z"}, {"uuid": "820a4b6a-ffc8-402f-b5f9-a1f4351d6b0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26914", "type": "seen", "source": "https://t.me/cibsecurity/23274", "content": "\u203c CVE-2021-26914 \u203c\n\nNetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in MvcUtil valueStringToObject.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-02-09T00:39:22.000000Z"}, {"uuid": "68e93e83-e5b3-442f-8df5-88963588b5c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26914", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/netmotion_mobility_mvcutil_deserialization.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"mr_me\", \"wvu \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated Java deserialization in the\\n          NetMotion Mobility server's MvcUtil.valueStringToObject() method, as\\n          invoked through the /mobility/Menu/isLoggedOn endpoint, to execute\\n          code as the SYSTEM account.\\n\\n          Mobility server versions 11.x before 11.73 and 12.x before 12.02 are\\n          vulnerable. Tested against 12.01.09045 on Windows Server 2016.\", \"disclosure_date\": \"2021-02-08\", \"fullname\": \"exploit/windows/http/netmotion_mobility_mvcutil_deserialization\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"NetMotion Mobility Server MvcUtil Java Deserialization\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/http/netmotion_mobility_mvcutil_deserialization.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/http/netmotion_mobility_mvcutil_deserialization\", \"references\": [\"CVE-2021-26914\", \"URL-https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/\", \"URL-https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020\", \"URL-https://srcincite.io/advisories/src-2021-0007/\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Windows Command\", \"Windows Dropper\", \"PowerShell Stager\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:55.819883Z"}]}