Deserialization Vulnerability in Apache Camel Affects Multiple Versions
CVE-2026-78162

10CRITICAL

Key Information:

Vendor: Apache
Status: Apache Camel
Vendor: CVE Published:; 19 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-78162?

A deserialization vulnerability within Apache Camel allows attackers to exploit bad configurations in the Hazelcast component, potentially leading to remote code execution. The issue arises because certain configuration paths do not apply JavaSerializationFilterConfig correctly, enabling unrestricted deserialization of Java objects. If an attacker can send serialized data to the Hazelcast cluster, they might execute arbitrary code within the context of the affected application. Users are advised to upgrade to Apache Camel version 4.23.0 or later to resolve this vulnerability, and implement recommended security practices in the interim.

Affected Version(s)

Apache Camel 4.0.0 < 4.18.5

Apache Camel 4.19.0 < 4.22.1

Apache Camel 4.18.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-78162
Created by oscerd