CVE-2026-86404

HIGHCVSS 8.8

Description

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.

Timeline

Published:September 7th, 2026 12:17 PM

Last modified:September 7th, 2026 2:16 PM

CVSS Scoring

CVSS v3: 8.8 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-502

References & Reports

Advisories, patches, and third-party reports

https://access.redhat.com/errata/RHSA-2026:53644
https://access.redhat.com/security/cve/CVE-2026-86404
https://bugzilla.redhat.com/show_bug.cgi?id=2477930

Source: NIST NVD · Data may lag official sources by up to one minute