External risk intelligence

Group-Office Insecure Deserialization Leading to Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-34838

Group-Office is a web-based groupware and CRM application. Such products are typically deployed as internet-facing web applications to provide remote access for employees and customers, making the interface reachable from the public internet in common deployment scenarios.

Deserialization

Intermesh Group Office

before 6.8.15625.0.1 to before 25.0.9026.0.1 to before 26.0.12

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Group-Office groupware and CRM tool could allow an authenticated user to execute arbitrary code on the server, potentially impacting data integrity and availability. This issue arises from insecure deserialization within the AbstractSettingsCollection model when processing setting strings. While the severity is high, the main concern at this level is confirming if Group-Office is in use and whether this specific vulnerability is present.

Insecure data handling allows server code execution.
Critical for confirming if Group-Office is deployed.
Assess usage and patch Group-Office instances.

Attack Path

How an attacker could exploit the issue

An attacker with existing access to Group-Office can exploit a flaw in how the application handles settings. By sending specially crafted data that includes a serialized object, the attacker can trick the application into writing arbitrary files to the server, which can then be used to execute commands remotely.

Authenticated access required.
Insecure deserialization of settings.
Leads to arbitrary file write and RCE.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an authenticated attacker could achieve arbitrary file writes and remote code execution on the server by injecting a serialized object into a setting string. This could affect the integrity and availability of the Group-Office application.

Server-side files and code could be overwritten.
Malicious serialized data could be injected.
Complete system compromise may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Group-Office application owners and the platform team are likely responsible for addressing this critical vulnerability. The first practical step is for asset owners to identify all instances of Group-Office, confirm their accessibility and business criticality, and then coordinate with the platform or infrastructure teams to plan remediation during the next maintenance window.

Application owners should lead remediation efforts.
Verify all Group-Office instances and exposure.
Plan and execute updates based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Group-Office?

Group-Office is a comprehensive enterprise suite designed to manage group communication and business operations. It combines customer relationship management (CRM) features with groupware tools like shared calendars, email, and file management, enabling teams to collaborate and store sensitive organizational data within a centralized web-based interface.

What does insecure deserialization mean for CVE-2026-34838?

This vulnerability falls under the CWE-502 weakness class, which occurs when an application trusts and reconstructs complex data structures—like serialized objects—without sufficient validation. In this case, the application's AbstractSettingsCollection model processes malicious data, allowing the system to be tricked into interpreting that data as executable instructions, eventually leading to full remote code execution.

How can an attacker trigger this vulnerability?

An attacker must have valid, authenticated access to the Group-Office application to initiate the attack. By injecting a specially crafted serialized FileCookieJar object into a specific setting string, they force the system to perform an unauthorized write operation. Simply interacting with the application's public login or standard, non-administrative features does not trigger this flaw.

Is my instance of Group-Office at risk?

If you are running an affected version, your risk depends on your deployment. Halo Surface Signal notes that Group-Office is typically configured as an internet-facing web application to support remote work, which increases the likelihood of unauthorized access. Instances hosted on private, internal-only networks may have a smaller attack surface, but authenticated users within those networks could still potentially exploit the flaw.

Do I need to update Group-Office to fix this?

Yes. To resolve this vulnerability, you must update your installation to version 6.8.156, 25.0.90, or 26.0.12 or newer, depending on your current branch. Start by identifying all active instances of the software in your environment and coordinating a maintenance window with your infrastructure team to apply these security updates promptly, as this is the primary method to mitigate the risk of arbitrary code execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.