CVE-2026-96344

Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.

• Published Sep 30, 2026
• CVSS 7.2 high
• 0.4% chance of exploitation in the next 30 days (EPSS)

CVE-2026-96344 at the National Vulnerability Database