---
id: "CVE-2026-116230"
kind: "vulnerability"
aliases: ["CVE-2026-116230"]
title: "Plague Inc Evolved: Workshop scenario loader deserialization flaw enables remote attack"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "games", "ios", "other", "plague-inc-evolved", "windows"]
not_affected_if: ["version-1.24.0.4-or-later"]
published_at: "2026-10-26T08:17:17+00:00"
first_seen_at: "2026-10-26T08:28:59+00:00"
updated_at: "2026-10-26T08:30:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116230", "first_seen_at": "2026-10-26T08:28:59+00:00"}]
---

# Plague Inc Evolved: Workshop scenario loader deserialization flaw enables remote attack

Plague Inc Evolved up to 1.24.0.3 has a deserialization flaw in its Workshop Scenario Loader component. A remote attacker can trigger it, and the sources do not say what code execution or data access results.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Plague Inc Evolved version on each device or install (the game client, not a server); flagged builds are up to `1.24.0.3`
- unknown for any other check, the sources do not say

## Fix

- Update Plague Inc Evolved to `1.24.0.4` or later, as the description recommends

## Timeline

- 2026-10-26T08:28:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116230

## From the sources

A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader. Such manipulation leads to deserialization. The attack may be performed from remote. Upgrading to version 1.24.0.4 is sufficient to fix this issue. It is recommended to upgrade the affected component.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_