High 8.4Published Nov 17, 2025

CVE-2025-60455Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code.

Updated under an hour ago (Oct 27, 2026, 1:10 PM ET)

Does this affect you?

It affects modular max. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for modular max

Exploited in the last 30 days

Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code.

CVSS: 8.4 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-502
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: mitre
NVD analysis: Analyzed
Record last updated: Nov 19, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

modular max modular:max	before 25.6.0	NVD

References

References

https://github.com/modular/modular/issues/4795	issue-tracking, patch
https://github.com/modular/modular/blame/main/max/serve/kvcache_agent/kvcache_agent.py#L220	broken-link
https://github.com/modular/modular/commit/10620059fb5c47fb0c30e5d21a8ff3b8d622fba4	patch
https://github.com/modular/modular/commit/ee9c4ab02345dd30bed8b79771b6909ff1b930a1	patch
https://github.com/modular/modular/commit/b20e749fa892dbe772e890a268002f732164d9f5	patch
https://www.oligo.security/blog/shadowmq-how-code-reuse-spread-critical-vulnerabilities-across-the-ai-ecosystem	exploit, third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.