CVE-2026-116230

Critical

9.8 CVSS v3.1 CVSS v4.0: 2.1

Published: Oct 26, 2026
Updated: Oct 28, 2026
Vendor: Ndemiccreations
Affected versions: See affected products
Weakness: CWE-20, CWE-502

Summary

A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader. Such manipulation leads to deserialization. The attack may be performed from remote. Upgrading to version 1.24.0.4 is sufficient to fix this issue. It is recommended to upgrade the affected component.

Severity

Critical (9.8)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v4.0 (2.1)

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Ndemiccreations Plague Inc <= 1.24.0.3

Exploitation status

Unknown

Technical details

Technical analysis has not been written for this record yet.

Mitigation & remediation

Follow the vendor advisory linked below for patches and workarounds.