External risk intelligence

Zoho Flow Unauthenticated PHP Object Injection

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-62131

Zoho Flow is a web application plugin typically deployed to facilitate integrations, making it a commonly internet-facing or edge-reachable component within web environments. The nature of this product as a connector frequently requires exposure to external web traffic or APIs in common deployment patterns.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in Zoho Flow, a product used for system integrations. The flaw, if exploited, could allow unauthorized access to sensitive information and system control. The primary concern is to confirm if this product is in use and assess any potential exposure.

Unauthenticated injection allows system compromise.
Critical flaw impacts integration products.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target the Zoho Flow component by sending specially crafted data over the network. This could lead to the injection of malicious PHP objects, potentially allowing the attacker to execute arbitrary code on the server.

No authentication required.
Specially crafted network input.
Server-side code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject serialized PHP objects into the application. When these objects are processed, it may lead to the execution of arbitrary code, potentially impacting the integrity and availability of the service and any data it handles. This could occur when the application deserializes untrusted input, a condition supported by the advisory's description of unauthenticated PHP Object Injection.

Application code and service behavior.
Malicious object injected via network.
Arbitrary code execution possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Resolving this unauthenticated PHP Object Injection vulnerability in Zoho Flow requires coordination between application owners, platform teams, and potentially vendor management. The first practical step is to identify all instances of the affected Zoho Flow versions, determine their exposure and criticality, and then assign ownership for remediation planning.

Application owners should prioritize this.
Verify external reachability and business impact.
Plan and execute remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Zoho Flow?

Zoho Flow is a software plugin designed to connect different web applications and automate workflows by integrating various services together. It acts as a bridge between systems, frequently deployed within web environments to handle data transfers and trigger tasks across platforms, which necessitates its connectivity to external web traffic or APIs.

What does PHP Object Injection mean for CVE-2026-62131?

This vulnerability, classified as CWE-502 (Deserialization of Untrusted Data), occurs when the software processes data from users without sufficient validation. Because the application trusts and deserializes malicious objects provided by an attacker, it inadvertently allows that attacker to inject code that the server then executes as if it were legitimate program instructions.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending specially crafted, malicious data over the network to the application. It is important to note that the attacker does not need a user account or password to initiate this; the flaw exists because the system processes this input before checking for authentication. Standard, non-malicious data traffic does not trigger the bug.

Is my Zoho Flow instance at risk?

According to Halo Surface Signal, this software is typically used as an integration connector, which often requires it to be reachable via the internet or edge network. If your instance is accessible from the public web to facilitate these integrations, it falls into a higher risk category for network-based attacks compared to systems isolated strictly within an internal network.

What should I do if I run this software?

Your first step is to locate all instances of the affected Zoho Flow versions within your environment. Once identified, evaluate the specific business function and network exposure of those systems. Coordinate with your platform and security teams to prioritize these instances for remediation planning and track the progress of updates to remove the vulnerability.

References

patchstack.com/database/wordpress/plugin/zoho-flow/vulnerability/wor…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.