Deserialization Flaw in Red Hat's Artemis Framework
CVE-2026-86404
Key Information:
What is CVE-2026-86404?
The Artemis framework by Red Hat has a significant deserialization issue where the default configuration allows deserialization of objects without proper restrictions. The ObjectMessage.getObject() method uses ObjectInputStreamWithClassLoader, which relies on an empty allow-list and block-list for filtering. This configuration flaw results in the isTrustedType() method returning true for all classes by default, creating an exploitable vector for untrusted data deserialization.
Affected Version(s)
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:2.16.0-22.redhat_00057.1.el7eap
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:2.3.14-11.SP11_redhat_00001.1.el7eap
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:1.5.26-2.Final_redhat_00001.1.el7eap