CVE-2026-86404
Received Received - Intake

Artemis Default Deserialization Vulnerability

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: redhat-SADP

Description
EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86404
EUVD
EUVD-2026-72352

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
red_hat enterprise_application_platform From 7.4.23 (inc)
red_hat enterprise_application_platform From 8.1.0 (inc)
red_hat artemis server
red_hat artemis jms_client
red_hat artemis core_client
red_hat undertow core
red_hat wildfly messaging_activemq_subsystem

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86404 is a deserialization vulnerability in Red Hat Enterprise Application Platform (EAP) related to Artemis. By default, the Artemis deserialization configuration allows deserialization of all classes because the allow-list and block-list filters are empty. This means ObjectMessage.getObject() permits deserialization of any class, creating a security risk where attackers could inject malicious ObjectMessage and deserialize gadget chain classes to execute unauthorized actions or compromise the system.

Detection Guidance

Detecting this vulnerability requires checking Artemis deserialization configurations. Review pooled-connection-factory resources for empty allow-lists in ObjectMessage.getObject() usage. Check logs for suspicious ObjectMessage deserialization events or unexpected class loading. Use network monitoring to detect unauthorized Artemis federation handler interactions or fake upstream broker registrations.

Impact Analysis

This vulnerability allows remote code execution (RCE) when combined with another flaw like CVE-2026-27446. Attackers can exploit unauthenticated Artemis federation handlers to inject serialized ObjectMessage into queues, bypassing authentication and executing arbitrary OS commands as the EAP process user. It impacts confidentiality, integrity, and availability with high severity (CVSS 8.8).

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or exfiltration, which directly conflicts with GDPR's data protection principles and HIPAA's safeguards for protected health information. The high-impact nature of this flaw (CVSS 8.8) means it could result in confidentiality breaches, integrity violations, and availability disruptions, all of which are critical compliance concerns under these regulations.

Mitigation Strategies

Immediately configure restrictive deserialization allow-lists on all pooled-connection-factory resources. For example, set allow-list to only trusted classes like 'com.yourapp.OrderEvent'. Disable unauthenticated Artemis federation handlers if not required. Apply vendor patches from Red Hat (RHSA-2026:53644, RHSA-2026:53806) for EAP 7.4 and monitor for updates for other versions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86404. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart