CVE-2026-86404

Awaiting Analysis Awaiting Analysis - Queue

Artemis Default Deserialization Vulnerability

Publication date: 2026-09-07

Last updated on: 2026-11-01

Assigner: redhat-SADP

Description

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-07

Last Modified

2026-11-01

Generated

2026-11-08

AI Q&A

2026-09-07

EPSS Evaluated

2026-11-07

NVD

CVE-2026-86404

EUVD

EUVD-2026-72352

Affected Vendors & Products

Vendor	Product	Version / Range
red_hat	enterprise_application_platform	From 7.4.23 (inc)
red_hat	enterprise_application_platform	From 8.1.0 (inc)
red_hat	artemis	server
red_hat	artemis	jms_client
red_hat	artemis	core_client
red_hat	undertow	core
red_hat	wildfly	messaging_activemq_subsystem

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

CVE-2026-86404 is a deserialization vulnerability in Red Hat Enterprise Application Platform (EAP) related to Artemis. By default, the Artemis deserialization configuration allows deserialization of all classes because the allow-list and block-list filters are empty. This means ObjectMessage.getObject() permits deserialization of any class, creating a security risk where attackers could inject malicious ObjectMessage and deserialize gadget chain classes to execute unauthorized actions or compromise the system.

Detection Guidance

Detecting this vulnerability requires checking Artemis deserialization configurations. Review pooled-connection-factory resources for empty allow-lists in ObjectMessage.getObject() usage. Check logs for suspicious ObjectMessage deserialization events or unexpected class loading. Use network monitoring to detect unauthorized Artemis federation handler interactions or fake upstream broker registrations.

Impact Analysis

This vulnerability allows remote code execution (RCE) when combined with another flaw like CVE-2026-27446. Attackers can exploit unauthenticated Artemis federation handlers to inject serialized ObjectMessage into queues, bypassing authentication and executing arbitrary OS commands as the EAP process user. It impacts confidentiality, integrity, and availability with high severity (CVSS 8.8).

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or exfiltration, which directly conflicts with GDPR's data protection principles and HIPAA's safeguards for protected health information. The high-impact nature of this flaw (CVSS 8.8) means it could result in confidentiality breaches, integrity violations, and availability disruptions, all of which are critical compliance concerns under these regulations.

Mitigation Strategies

Immediately configure restrictive deserialization allow-lists on all pooled-connection-factory resources. For example, set allow-list to only trusted classes like 'com.yourapp.OrderEvent'. Disable unauthenticated Artemis federation handlers if not required. Apply vendor patches from Red Hat (RHSA-2026:53644, RHSA-2026:53806) for EAP 7.4 and monitor for updates for other versions.

Hi! I’m here to help you understand CVE-2026-86404. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...