CVE-2021-26914: NetMotion Mobility Java deserialization allows unauthenticated RCE as SYSTEM

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated network-reachable RCE as SYSTEM with public exploit references and very high EPSS, though not yet in KEV.

What it is

NetMotion Mobility before 11.73 and 12.x before 12.02 deserializes untrusted data in MvcUtil valueStringToObject, letting an unauthenticated remote attacker execute arbitrary code. Because the code runs as SYSTEM, a successful hit gives full control of the Mobility server.

Impact

An attacker gains remote code execution with SYSTEM privileges on the NetMotion Mobility server, enabling full compromise of the host and any data or credentials it handles.

Attack surface

Reached over the network via the Mobility web server; the CVSS vector shows no privileges and no user interaction required, so the flaw is exploitable pre-authentication.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.777, 99.5th percentile) and multiple references are tagged Exploit, indicating public exploit code exists.

What to do

• Upgrade NetMotion Mobility to 11.73 or 12.02 (or later) as directed by the vendor advisory.
• If immediate patching is not possible, restrict network access to the Mobility web server to trusted management networks only.
• Monitor and block deserialization attack patterns at the web tier (WAF or reverse proxy) as a temporary control.
• Confirm the Mobility web server is not exposed to the internet and review firewall rules for unnecessary exposure.

Detection

• Review Mobility web server logs for anomalous requests to MvcUtil or deserialization-related endpoints.
• Alert on unexpected child processes spawned by the Mobility/Java service, especially those running as SYSTEM.
• Monitor for outbound connections from the Mobility server to unknown hosts that could indicate post-exploitation activity.
• Hunt for known Java deserialization gadget payloads in HTTP request bodies reaching the Mobility web server.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.