vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2018-15616

System Platform Web UI Deserialization

CRITICAL
9
CVSS Score
Published: October 17, 2018 at 07:00 PM UTC
Updated: June 17, 2026 at 01:42 AM UTC
1 product affected across 1 vendorAvaya Aura® System Platform

Using Avaya Aura® System Platform by Avaya?

Get instant alerts when new vulnerabilities affect Avaya Aura® System Platform - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
CRITICAL9
Exploit prediction
EPSS 3%

Description

A vulnerability in the Web UI component of Avaya Aura System Platform could allow a remote, unauthenticated user to perform a targeted deserialization attack that could result in remote code execution. Affected versions of System Platform includes 6.3.0 through 6.3.9 and 6.4.0 through 6.4.2.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Avaya Aura® System Platform· Avaya
95%
6.3.0 ≤ v ≤ 6.3.96.3.x ≤ v ≤ 6.3.96.4.0 ≤ v ≤ 6.4.26.4.x ≤ v ≤ 6.4.26.3.x6.4.x

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (1)

x_refsource_CONFIRMExploitVendor Advisory
Source: [email protected]
https://downloads.avaya.com/css/P8/documents/101052865

CVSS

9CRITICALavaya
Attack Vector
NETWORK
Complexity
HIGH
Privileges
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-502

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card