Update Kalles CMS Past 1.1.7.1 to Fix Critical 9.8-Scored PHP Object Injection

The National Vulnerability Database has published a critical security advisory for Kalles CMS, identifying a severe flaw in versions up to 1.1.7.1. The issue, tracked as CVE-2026-62076, carries a CVSS score of 9.8, marking it as a critical risk that requires immediate attention from administrators.

This vulnerability stems from an unauthenticated PHP object injection weakness, categorized as CWE-502. Attackers can exploit this flaw without needing valid login credentials, allowing them to manipulate PHP objects within the application. Such access can lead to unauthorized code execution or data compromise on affected servers.

Technical Context and Background

The National Vulnerability Database records indicate that the core issue lies in how Kalles CMS handles PHP object serialization. The weakness allows an attacker to inject malicious objects into the application’s processing stream. Because the attack vector is unauthenticated, any user on the internet can trigger the exploit without interacting with login forms.

The Common Weakness Enumeration classifies this as CWE-502, which refers to improper restriction of operations within a PHP environment. This classification highlights the failure to validate or sanitize user-supplied data before it is processed by the PHP engine. The high severity score reflects the ease of exploitation and the potential impact on system integrity.

Who Is Affected

All installations of Kalles CMS running version 1.1.7.1 or earlier are vulnerable to this attack. The NVD record explicitly states that "The4 Kalles up to 1.1.7.1" are affected. This includes any small business websites or internal portals currently using these older releases. Administrators must verify their current version immediately to determine if they are exposed to this critical threat.

No newer versions have been confirmed as safe in the provided source material, but the advisory specifically targets the 1.1.7.1 release and all prior iterations. Users who have not updated their CMS in some time are at the highest risk. The lack of authentication requirements for the attack makes every exposed instance a potential target for automated scanning tools.

What to watch

Administrators should monitor their server logs for unusual PHP execution patterns or unexpected object serialization attempts. Security teams should watch for official announcements from the Kalles CMS developers regarding patched versions. Additionally, keeping an eye on the NVD for updates to this CVE record can provide clarity on whether newer versions are also impacted.

Network monitoring tools should be configured to alert on suspicious traffic directed at CMS endpoints. Since the attack is unauthenticated, spikes in failed or successful injection attempts may appear in web server logs. Early detection of these patterns can help mitigate damage before an attacker gains full control of the system.

Background: PHP object injection

Prevent PHP object injection by disabling the magic method `__wakeup()` and avoiding `unserialize()` on user input. Replace object serialization with JSON or structured data formats. Validate all incoming data types strictly. Use allowlists for expected data structures. Never trust external sources with serialized objects, as this bypasses standard security controls and leads to remote code execution.

Read the full guide: Stop PHP Object Injection: Priority Fixes for Secure Code

What to do and how to stay safe: Kalles CMS

• Verify the current version of Kalles CMS installed on your servers and compare it against the affected range up to 1.1.7.1.
• Review web server access logs for signs of unauthenticated requests attempting to inject PHP objects into application parameters.
• Restrict access to administrative and sensitive CMS endpoints using firewall rules or IP whitelisting until a patch is confirmed.
• Monitor official vendor channels and the NVD for release notes confirming which versions resolve CVE-2026-62076.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of CVE-2026-62076?

The National Vulnerability Database rates CVE-2026-62076 as critical with a CVSS score of 9.8.

Which versions of Kalles CMS are affected?

All versions of Kalles CMS up to and including 1.1.7.1 are affected by this vulnerability.

Does this flaw require attacker authentication?

No, the source material describes the flaw as an unauthenticated PHP object injection, meaning no login is required.