External risk intelligence

MaxSite CMS Unauthenticated PHP Object Injection in maxsite_comuser Cookie

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-70554

The vulnerability exists in MaxSite CMS, which is a web application designed to be deployed as a public-facing website. The exploit is triggered via a cookie in an HTTP request, making it reachable by any remote user accessing the public-facing web interface of the application.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

MaxSite CMS has a critical vulnerability that allows unauthenticated attackers to execute arbitrary code by manipulating a specific cookie. This issue arises from improper handling of serialized data, potentially enabling sophisticated attacks by exploiting available programming techniques. The main concern is confirming relevance and exposure due to the unauthenticated nature and potential for remote code execution.

Unauthenticated code execution via cookie manipulation.
High impact due to remote, unauthenticated exploitability.
Confirm relevance and exposure; understand potential impact.

Attack Path

How an attacker could exploit the issue

An attacker can execute arbitrary code on a MaxSite CMS by sending a crafted HTTP request containing malicious serialized data within the `maxsite_comuser` cookie. This data is processed without proper validation, leading to the execution of attacker-controlled code on the server.

No authentication required.
Malicious cookie in HTTP request.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could execute arbitrary code on MaxSite CMS by sending a crafted serialized PHP object in the `maxsite_comuser` cookie. This exploit leverages PHP's object deserialization process, potentially leading to remote code execution when available gadget chains are present.

Server-side code execution.
Via crafted `maxsite_comuser` cookie.
Complete system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated PHP object injection vulnerability in MaxSite CMS requires immediate attention from teams responsible for web application security and infrastructure. The first practical step is to identify all instances of MaxSite CMS across your environment, determine their exposure (especially public-facing ones), and confirm their business criticality. Subsequently, coordinate with the accountable owners to plan and execute remediation, potentially involving vendor engagement or temporary risk reduction measures if immediate patching is not feasible.

Identify MaxSite CMS instances and exposure.
Confirm accountable owners and business criticality.
Plan remediation or risk reduction strategy.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MaxSite CMS?

MaxSite CMS is a PHP-based content management system. It provides a framework for building and maintaining dynamic websites, allowing users to organize content and manage site structure. Developers use it to deploy web platforms that handle user sessions and data persistence through features like cookies.

What does PHP object injection mean for CVE-2026-70554?

This vulnerability, classified as CWE-502, occurs when an application processes untrusted serialized data without validation. In this CVE, the software takes data from the 'maxsite_comuser' cookie and uses the unserialize() function on it. An attacker can use this to inject custom PHP objects, which forces the server to execute unintended code or manipulate application logic based on the classes present in the environment.

How is the vulnerability triggered?

An attacker triggers this by sending a single, specifically crafted HTTP request containing a malicious serialized payload within the 'maxsite_comuser' cookie. No prior authentication is needed. The vulnerability is not triggered if the cookie is missing or if the data within it follows the application's expected, non-serialized format.

Do I need to worry if my MaxSite CMS is internal?

According to Halo Surface Signal, this vulnerability is particularly relevant to public-facing websites because the exploit relies on reaching the web interface remotely. If your MaxSite CMS instance is exposed to the internet, it is directly reachable by external actors. Internal-only instances face lower immediate risk, but should still be secured.

What is the first step to address this issue?

Start by performing an inventory of your environment to locate all running instances of MaxSite CMS. Once identified, evaluate which systems are internet-facing, as these represent the highest risk. Coordinate with the teams responsible for these applications to assess the feasibility of patching or applying risk-reduction measures while you prepare for a permanent update.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.