CVE-2020-7961: listed in the CISA KEV catalog

CVE-2020-7961 · CVSS 9.8 CRITICAL · EPSS 99.9% · KEV 2021-11-03 · patch available

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).

Is CVE-2020-7961 exploited?

• Listed in the CISA KEV catalog on 2021-11-03.
• Federal remediation due 2022-05-03.
• Past that date by 1655 days.
• EPSS puts exploitation in the next 30 days at 99.9%.
• Public exploit code: packaged in a public tool.
• Public detection rules exist.

Which products and versions are affected?

• liferay · liferay portal · < 7.2.1

Is there a patch?

Yes. Update to one of these or later:

From NVD's analysis

What PlainSec published about CVE-2020-7961

• DeepSeek agent adapted as telecom defenses blocked attacks (2026-11-10)

Primary sources

• NVD record
• CISA KEV catalog
• Metasploit: exploit/multi/http/liferay_java_unmarshalling
• Exploit-DB 48332
• Nuclei template

KEV and EPSS are re-checked daily. Record last updated 2026-11-10.