CVE-2026-78286

Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.

Published Aug 27, 2026
CVSS 9.8 critical
0.6% chance of exploitation in the next 30 days (EPSS)

Affected software

INFINITUM FORM Geo Controller

CVE-2026-78286 at the National Vulnerability Database