CVE-2026-120135 – Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default

Upon confirmation or strong suspicion of exploitation related to CVE-2026-120135, immediate actions are critical to contain the threat and preserve forensic evidence. This vulnerability involves a critical deserialization flaw in the AcmeFramework SessionHandler Library, leading to unauthenticated remote code execution (RCE).

a. Isolate Affected Systems: Immediately disconnect or segment any web servers or application instances running the vulnerable AcmeFramework component from the network. If full isolation is not feasible, restrict inbound traffic to only essential administrative ports from trusted sources.
b. Preserve Evidence: Before making any changes, create full memory dumps and disk images of the affected systems. This is crucial for forensic analysis to understand the extent of compromise, attacker methods, and data exfiltration.
c. Block Malicious Traffic: Implement temporary firewall rules at the network perimeter or host-based firewalls to block any known malicious IP addresses or patterns associated with the exploitation of this deserialization vulnerability. Monitor web server access logs for unusual POST requests or large, malformed session data.
d. Review and Rotate Credentials: Assume that any credentials stored on or accessible by the compromised system may have been exfiltrated. Immediately rotate all API keys, database credentials, and user passwords associated with the affected application and any integrated services.
e. Incident Response Team Notification: Engage your organization's incident response team to coordinate further investigation, containment, eradication, and recovery efforts.
f. Disable Vulnerable Functionality (If Feasible): If the specific session management feature responsible for the deserialization vulnerability can be temporarily disabled without critical business impact, do so as a stop-gap measure. This might involve disabling specific session persistence mechanisms or switching to a non-deserializing session handler.

2. PATCH AND UPDATE INFORMATION

The primary remediation for CVE-2026-120135 is to apply the vendor-provided patch.

a. Affected Versions: AcmeFramework versions 3.0.0 through 3.5.2 are confirmed to be vulnerable. This includes applications directly using the 'AcmeFramework-SessionHandler' library or those bundled with these framework versions.
b. Patched Versions: The vulnerability is addressed in AcmeFramework version 3.5.3 and all subsequent versions (e.g., 4.0.0 and later).