CVE-2025-60887 — Cista Insecure Deserialization

April 28, 2026 19:16 /MEDIUM /CVSS 5.3/10

Written by SCW Vulnerability Desk Vulnerability Intelligence

National Vulnerability Database vulnerabilitycvemedium-severityinsecure-deserialization

CVE-2025-60887 — Cista Insecure Deserialization

CVE-2025-60887 — An issue was discovered in Cista v0.15 and below. Insecure deserialization of untrusted input under certain conditions may lead to leaking of stack/heap addresses which may be used to bypass ASLR. Classes with pointer-like mechanics under the cista::raw namespace are prone to refere

What This Means For You

If your environment is affected by this vulnerability type, review your exposure and prioritize patching based on your environment. Monitor vendor advisories for CVE-2025-60887 updates and patches.

Related ATT&CK Techniques

T1574.002 DLL Side-Loading Privilege Escalation T1055.012 Process Hollowing Privilege Escalation T1059.001 PowerShell Execution

🛡️ Detection Rules

3 rules · 6 SIEM formats

3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.

critical T1574.002 Execution

CVE-2025-60887 - Cista Insecure Deserialization Payload Attempt

Sigma YAML — free preview

title: CVE-2025-60887 - Cista Insecure Deserialization Payload Attempt
id: scw-2026-04-28-ai-1
status: experimental
level: critical
description: |
  Detects attempts to exploit CVE-2025-60887 by sending a POST request to a URI path likely associated with Cista deserialization, containing a 'payload' query parameter. This targets the insecure deserialization vulnerability where untrusted input can lead to information disclosure and potential bypass of ASLR.
author: SCW Feed Engine (AI-generated)
date: 2026-04-28
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2025-60887/
tags:
  - attack.execution
  - attack.t1574.002
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/cista/deserialize'
      cs-uri-query|contains:
          - 'payload='
      cs-method:
          - 'POST'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse

✓ Sigma · Splunk SPL Sentinel KQL Elastic QRadar AQL Wazuh Get rules for your SIEM →

Indicators of Compromise

ID	Type	Indicator
CVE-2025-60887	vulnerability	CVE-2025-60887

Written by SCW Vulnerability Desk

Source & Attribution

Source Platform	NVD
Channel	National Vulnerability Database
Published	April 28, 2026 at 19:16 UTC

This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.

Believe this infringes your rights? Submit a takedown request.

Follow

Share