Unpatched Kaltura mwEmbed Deserialization Flaws (CVE‑2026‑19912, CVE‑2026‑19913) Enable Remote File Read & Code Execution
What It Is – The CERT Coordination Center disclosed two critical flaws in Kaltura’s HTML5 mwEmbed video‑player library. Both CVEs stem from an unsafe PHP deserialization in mwEmbedLoader.php, allowing an unauthenticated attacker to read arbitrary files on the host and execute arbitrary PHP code.
Exploitability – No public exploit code has been released, but the vulnerabilities are remote, require no authentication, and are actively being weaponised in the wild. CVSS scores have not been published; industry analysts rate the risk as High given the “remote code execution” impact.
Affected Products – Kaltura mwEmbed player (any web application embedding the library, typically via the mwEmbedLoader.php endpoint).
Why It Matters for Compliance & Audit Readiness
- Control Mapping: The flaw maps directly to SOC 2 CC6.1 (System Operations) and CC7.1 (Change Management). Demonstrating that you have documented, tested, and continuously monitored these controls is essential when auditors ask how you mitigate “unauthorized code execution.”
- Continuous Evidence: Real‑time detection of anomalous file‑read or code‑execution attempts provides audit‑ready logs that prove you’re actively managing the risk.
- Vendor‑Risk Due Diligence: If you rely on Kaltura as a third‑party video service, the vulnerability must be reflected in your vendor‑risk register and monitored until a patch is applied.
Recommended Actions
- Inventory every web asset that loads the Kaltura mwEmbed library; tag them in your CMDB.
- Apply Vendor Patch as soon as Kaltura releases one; if unavailable, implement a temporary WAF rule that blocks deserialization payloads to
mwEmbedLoader.php. - Map to SOC 2 Controls – document the vulnerability under CC6.1 and CC7.1, capture remediation evidence (patch tickets, WAF rule screenshots) for audit.
- Enable Logging & Alerting – log all requests to
mwEmbedLoader.php; set alerts for unexpected file‑read or code‑execution patterns. - Update Vendor‑Risk Program – record the finding, assign a risk rating, and schedule continuous monitoring of Kaltura’s security advisories.
Source: The Hacker News – Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code