ACTIVELY EXPLOITED
CVE-2020-7961: Liferay Portal Deserialization of Untrusted Data Vulnerability
| Vendor | Liferay |
|---|---|
| Product | Liferay Portal |
| Actively exploited | Yes |
| Added to CISA KEV | 3 Nov 2021 |
| CISA federal deadline | 3 May 2022 |
| Weakness (CWE) | CWE-502 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Liferay Portal contains a deserialization of untrusted data vulnerability that allows remote attackers to execute code via JSON web services.
SOURCES
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.