CVE-2018-0147: Cisco Secure Access Control System Java deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution as root on an identity management appliance, with confirmed exploitation per CISA KEV and high EPSS score.

What it is

Cisco Secure Access Control System (ACS) before release 5.8 patch 9 deserializes user-supplied content insecurely, allowing a crafted serialized Java object to trigger arbitrary command execution. The flaw is remotely reachable without authentication and yields root-level control of the ACS appliance, which is a core identity and access management component.

Impact

An unauthenticated attacker can execute arbitrary commands with root privileges on the affected device, leading to full compromise of the ACS host and any credentials or policy data it manages.

Attack surface

Reachable over the network via a crafted serialized Java object sent to the affected service; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required.

Exploitation

CVE-2018-0147 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-25), and EPSS shows a 30-day exploitation probability of roughly 18% (97th percentile), indicating observed exploitation activity.

What to do

• Upgrade Cisco Secure Access Control System to release 5.8 patch 9 or later as directed by the vendor advisory.
• If ACS cannot be patched immediately, restrict network access to the ACS management and service interfaces to trusted hosts only.
• Monitor and block untrusted serialized Java object traffic at network boundaries where feasible.
• Retire or isolate end-of-life ACS deployments that cannot receive vendor fixes.
• Review ACS host integrity and credentials for signs of prior compromise before returning it to service.

Detection

• Inspect network and application logs for serialized Java object payloads or deserialization errors targeting ACS endpoints.
• Alert on unexpected child processes, shell execution, or outbound connections originating from the ACS host.
• Monitor for anomalous authentication or configuration changes on ACS following suspicious inbound requests.
• Correlate ACS host telemetry with known exploitation indicators and CISA KEV guidance for this CVE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.