CERT/CC disclosed two critical unpatched vulnerabilities in Kaltura's mwEmbed HTML5 video player library that expose servers to remote code execution and arbitrary file reading attacks. An unauthenticated attacker needs only network access to exploit these flaws.
The vulnerabilities, CVE-2026-19913 and CVE-2026-19912, originate from unsafe deserialization in the mwEmbedLoader.php endpoint. This design flaw allows attackers to manipulate serialized data sent to the server. When the application deserializes this malicious input without validation, it triggers unintended object instantiation and method execution on the target system.
Kaltura serves as the video infrastructure backend for thousands of organizations globally. Educational institutions, media companies, and enterprises rely on mwEmbed to deliver video content across web properties. Many deploy Kaltura in mission-critical environments handling sensitive content and internal communications.
The remote code execution vector poses the most severe risk. An attacker could gain shell-level access to underlying servers without authentication. This enables lateral movement into internal networks, data exfiltration, and persistence mechanisms. Organizations running unpatched Kaltura instances face exposure of database credentials, configuration files, and proprietary video content.
The arbitrary file reading capability compounds the threat. Attackers can extract sensitive files including configuration scripts containing database passwords, API keys stored in plaintext, and source code repositories. This reconnaissance data fuels secondary attacks against connected systems and third-party services.
The disclosure timing matters here. CERT/CC published the advisory while patches remain unavailable. Kaltura has not released fixed versions of mwEmbed. This creates a dangerous window where defenders cannot patch but must still operate vulnerable systems. Organizations cannot simply apply security updates.
Kaltura users face immediate action requirements. Security teams should inventory all mwEmbed deployments and document network exposure. Firewall rules merit review to restrict access to mwEmbedLoader.php endpoints from untrusted networks. Web application firewalls (WAF) may detect and block malicious deserialization payloads, though this requires rules tuned to mwEmbed's specific vulnerable patterns.
Monitoring becomes essential. Log analysis tools should flag unusual POST requests to mwEmbedLoader.php, especially those containing serialized PHP objects or base64-encoded payloads. Network detection systems require signatures for exploitation attempts if vendors release them.
Risk assessment should prioritize mwEmbed instances accessible from the internet. Deployments behind corporate firewalls with restricted inbound access present lower risk than public-facing CDN endpoints. Organizations should document this threat in their vulnerability management systems as a "zero-day in use" scenario requiring compensating controls until patches arrive.
Kaltura customers should contact vendor support for patch timelines and temporary mitigation guidance. The company may provide workarounds or request credential restrictions. Some deployments warrant temporary service shutdowns or functionality restrictions pending fixes.
This vulnerability class persists in video infrastructure because serialization frameworks enable flexible object handling but introduce deserialization attacks when untrusted data flows through them. PHP's native serialization functions remain particularly dangerous without strict type enforcement. Developers should avoid deserializing untrusted data entirely, or implement cryptographic signing to verify data integrity before deserialization processes begin.
The software development community should note that unsafe deserialization ranks among the most exploited vulnerability categories. Regular code reviews, input validation, and architectural changes away from serialization dependencies would prevent entire classes of remote attacks across the industry.