CVE-2026-82384 Unauthenticated XML-RPC Deserialization (RCE)

CVE-2026-82384 is a critical-severity vulnerability. AttackerView checks Apache Roller sites for it with a live exploit check.

Is my site vulnerable to CVE-2026-82384?

Detects Apache Roller 6.1.5 blog servers whose XML-RPC endpoint deserializes untrusted bytes before anyone has logged in. Roller wires the XML-RPC servlet up with its library's vendor extension value types switched on, and one of those types carries a base64 blob that Java turns back into a live object while the request is still being read. Because the endpoint is wired in unconditionally, that happens even on sites that left XML-RPC switched off, so no unusual configuration is needed. The verifier posts one such value whose payload starts with four random bytes and no serialized object at all, then confirms the server quotes those exact four bytes back as the object header it refused. Only Java's deserialization routine can produce that reply, which proves attacker-controlled bytes reach it with no credentials, the first half of a remote code execution chain. Upgrade to Apache Roller 6.1.6 or later, which turns the extension types off and closes the endpoint while the XML-RPC feature is disabled.