Who is not affected by CVE-2026-62131?

Not affected if: version-above-2.14.5.

Live › vulnerability › CVE-2026-62131

critical9.8Package

Zoho Flow: unauthenticated PHP object injection lets attackers run code

Zoho Flow versions up to 2.14.5 deserialize attacker-supplied PHP objects without authentication. A remote attacker can use this to potentially execute code on the affected system.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 29, 2026 UTC
Last modified: Oct 29, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.

Who is affected

No product ranges from the sources yet.

Who cares: php, wordpress, zoho-flow
Not affected if: version-above-2.14.5

How to check

Check the installed Zoho Flow plugin version against the affected range <= 2.14.5

The fix

Move to a Zoho Flow version newer than 2.14.5; the exact fixed version is unknown

Who had it, and when

1 source

NVD2026-10-29 16:26 UTC · published 2026-10-29 16:18 UTC · CVE-2026-62131

Each row is the first time that source carried this signal. The analyst’s rows are its own findings.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-62131

critical9.8Package

Zoho Flow: unauthenticated PHP object injection lets attackers run code

Zoho Flow versions up to 2.14.5 deserialize attacker-supplied PHP objects without authentication. A remote attacker can use this to potentially execute code on the affected system.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 29, 2026 UTC
Last modified: Oct 29, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.

Who is affected

No product ranges from the sources yet.

Who cares: php, wordpress, zoho-flow
Not affected if: version-above-2.14.5

How to check

Check the installed Zoho Flow plugin version against the affected range <= 2.14.5

The fix

Move to a Zoho Flow version newer than 2.14.5; the exact fixed version is unknown

Who had it, and when

1 source

NVD2026-10-29 16:26 UTC · published 2026-10-29 16:18 UTC · CVE-2026-62131

Each row is the first time that source carried this signal. The analyst’s rows are its own findings.

Know the next one before it finds you.

Add to Slack

Zoho Flow: unauthenticated PHP object injection lets attackers run code

Who is affected

How to check

The fix

Who had it, and when

Know the next one before it finds you.

Zoho Flow: unauthenticated PHP object injection lets attackers run code

Who is affected

How to check

The fix

Who had it, and when

Know the next one before it finds you.

What the sources say, verbatim

Sources