CVE-2026-97865 is a high severity (CVSS 7.3) deserialization flaw in Open Web Analytics up to version 1.8.1, in the remote event queue endpoint. The record says upgrading to 1.8.2 fixes it. Upgrade, then check whether that endpoint needs to be reachable from the internet at all.
What's affected
The NVD record describes Open-Web-Analytics up to and including 1.8.1. The affected code is the function Event::loadFromArray in the file queue.php, part of the Remote Event Queue Endpoint. The record gives the fixed version as 1.8.2 and names the patch commit 78c1222ec0e2119d84684032da1541120a2cdd23.
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which means the network is the attack path, no privileges and no user interaction are needed, and the impact is rated low across confidentiality, integrity and availability. The score is 7.3. The record's KEV flag is false, so CISA does not list this as exploited in the wild.
One detail from the project's release page for 1.8.2: it was published on 22 July 2026, earlier than this CVE record, and it describes a maintenance release with multiple security improvements across input handling, output escaping, capability checks and query construction. It does not name this CVE, so rely on the record and the commit for the specific fix.
How to check if you're exposed
Start with the version. If you installed from a release archive, compare the version shown in your Open Web Analytics admin area, or the version file in the install directory, with 1.8.2. If you deploy from a git checkout, run git describe with the tags option in the install directory and see whether the result is older than 1.8.2.
Next, find out whether the queue endpoint is reachable from outside. Search your web server access log for requests to queue.php, for example with grep on the log path for your setup. Requests from unexpected addresses are worth a closer look, though a clean log does not prove the endpoint was never probed.
If you run several instances, including old test installs that nobody remembers, include them in the check. Analytics tools tend to be installed once and left alone.
What to do now
- Upgrade Open Web Analytics to 1.8.2 or later. Take a backup of the database and the config first.
- If you cannot upgrade today, restrict access to queue.php at the web server or firewall so that only the systems that need to send events can reach it. Test that tracking still works afterwards.
- Review access logs for unusual requests to the queue endpoint around and after 25 September 2026, the date the CVE was published.
- Check the project release notes and the GitHub issue linked from the record for any further upgrade steps.
- Add the application to your software inventory so the next advisory finds you quickly.
Why it matters
The weakness types are CWE-20, CWE-502. Deserialization flaws arise when an application rebuilds objects from data it received without strictly checking what that data is allowed to contain. If the input is attacker controlled, the application may end up creating objects or setting values the developers never intended. The record describes the flaw at this level, and the project fixed it in code.
An analytics collector is a common target for this kind of bug because it is designed to accept data from the open internet. The endpoint that receives events has to be public, so the safe fix lives in how it parses what arrives, not in hiding it.
The rated impact is low on each axis, so this is not the most severe flaw you will see this month. It still deserves a routine patch because it needs no login and the fix is a single version bump.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan. It covers packages and libraries your projects pull in, so it will not see a standalone application or a kernel, but it is a quick way to find out which third party components you are carrying at all. Reachability analysis then helps you separate vulnerable code that your application actually calls from code that only sits in a dependency tree.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2026-97865 exploited in the wild?
The record shows kev as false, meaning it is not in the CISA Known Exploited Vulnerabilities catalog, and the sources we could read do not say it is exploited. That can change, so check the Gold page for current status.
Which version fixes it?
The record says Open Web Analytics 1.8.2. The release notes for 1.8.2 describe general security hardening and do not name this CVE, so treat the record and the patch commit as the reference.
Sources
Gold entry for CVE-2026-97865 Open Web Analytics 1.8.2 release Patch commit 78c1222 Project issue 960 and pull request 967, listed in the record but not readable when this post was written VulDB entry
Last reviewed: 18 October 2026.
