VulnerabilityDeferred

CVE-2026-38950

An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files.

HIGH 7.8EPSS 0.14%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.14%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files. The affected components load model files from session directories using torch.load() with unrestricted deserialization.

CVSS 3.1: 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.14% probability · 4th percentile
CISA KEV: Not listed
Weakness: CWE-502
Source: cve@mitre.org

References

https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
https://github.com/esa/AnomalyMatch/pull/9
https://imlabs.info/research/security_advisory_esa_anomaly_match_unsafe_deserialization_cve_2026_38950_ivan_markovic_052026.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.