Checkbox Survey Deserialization of Untrusted Data Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2021-27852 · Published 27/05/2021 · updated 17/06/2026

Checkbox Survey Deserialization of Untrusted Data Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 11/04/2022. Patch affected systems as an emergency.

In short

CVE-2021-27852 is a CRITICAL (CVSS 9.8) vulnerability affecting survey (checkbox).
Exploited in the wild: CISA added it to the KEV catalog on 11/04/2022.
Chance of exploitation in the next 30 days (EPSS): 30.3%, higher than 98.2% of all vulnerabilities.
Fix: update to 7.0 or later.

Package	Affected versions	Patched versions
survey checkbox	`< 7.0`	`7.0`

Description

Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.

References

kb.cert.org/vuls/id/706695 · Third Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2021-27852

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free