External risk intelligence

Univer Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-88405

The vulnerability resides in a remote service function within a web application framework. Such services are commonly exposed as API endpoints or backend components in web applications, making them reachable via the network in standard deployments.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a remote function service that could allow unauthorized code execution. This issue affects web application frameworks and warrants a review to determine potential exposure within our systems. The primary concern is to ascertain if our environment utilizes the affected technology and, if so, to assess the associated risk.

Remote code execution vulnerability found.
Could impact web application frameworks.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted payload to the RemoteRegisterFunctionService function. This service is accessible over the network and does not require any special privileges or user interaction to be triggered. If successful, the attacker could execute arbitrary code on the affected system.

No authentication or privileges needed.
Remote code execution via crafted payload.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A critical remote code execution vulnerability in a remote service function could allow an unauthenticated attacker to run arbitrary code on the affected system. This could occur when the service is accessible over a network and receives a specially crafted request. The potential impact includes unauthorized code execution and system compromise.

Arbitrary code execution on the system.
Network-accessible service receives crafted payload.
System compromise and unauthorized actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Univer's RemoteRegisterFunctionService impacts applications using this component. Owners of affected applications, platform teams managing the Univer deployment, and network/security teams responsible for external access must collaborate. The immediate first step is to identify all instances of Univer, confirm their network exposure and business criticality, and then prioritize remediation based on risk.

Identify application owners.
Verify network exposure and criticality.
Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Univer and where is it used?

Univer is a web application framework that includes specialized services for remote function registration. Developers integrate this technology into their software architectures to handle backend operations or distributed tasks, allowing different parts of an application to register and communicate via the network.

What does CWE-94 mean for CVE-2026-88405?

CWE-94 refers to improper control of generation of code, often called Code Injection. In the context of CVE-2026-88405, this weakness means the application fails to sanitize inputs before processing them. An attacker can supply malicious data that the system mistakenly interprets as valid programming instructions, leading to unauthorized code execution.

How does an attacker trigger this vulnerability?

An attacker triggers this issue by sending a specially crafted data payload to the RemoteRegisterFunctionService endpoint. Because the service lacks input validation, it processes this payload directly. Simply accessing the service is enough; the bug is not triggered by standard, legitimate requests that follow the expected data format.

Do I need to worry about this if my app is internal?

Halo Surface Signal indicates this vulnerability is likely reachable over the network because the affected service function is often exposed as an API endpoint. While internet-facing instances are at the highest risk, internal systems might also be vulnerable if they are reachable by unauthorized users on your local network segment.

How should I begin responding to this alert?

Start by auditing your software inventory to locate every instance of the Univer framework. Once mapped, confirm which components are connected to the network and evaluate the business impact of those services. Focus on restricting unauthorized access to the RemoteRegisterFunctionService while coordinating with your development team to plan a security update.

References

github.com/czx1111/cve/issues/9

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.