CVE-2026-86404
Description
EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.
Statement
A flaw was found in Red Hat JBoss Enterprise Application Platform (EAP) in the Apache ActiveMQ Artemis messaging integration, where deserialization of JMS ObjectMessage payloads is permitted by default. ObjectMessage.getObject() deserializes through ObjectInputStreamWithClassLoader, which supports allow-list/block-list filtering, but by default both lists are empty, so all classes are treated as trusted and deserializable. An attacker who can deliver a crafted serialized ObjectMessage into a queue consumed by a message-driven bean can cause arbitrary classes to be deserialized when getObject() is invoked, potentially resulting in remote code execution with the privileges of the EAP process if suitable gadget classes are reachable from the deployment classloader. Red Hat rates this flaw as Important (CVSS 3.1: 8.8/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); the originally reported unauthenticated remote-code-execution scenario requires chaining this flaw with the separate Artemis federation missing-authentication flaw tracked as CVE-2026-27446. Red Hat JBoss EAP 7.4, 8.1, and 8.2 are affected, and fixes are being pursued by the responsible engineering teams. The Red Hat build of Apache Camel (Camel Spring Boot 4.18 and Camel Quarkus 3.20) and Red Hat AMQ 7 (7.13 and 7.14) are not affected because the vulnerable code is not present or not in the execute path in those products.
Mitigation
Configure a restrictive deserialization-allow-list on every pooled-connection-factory resource. For example, if your MDBs only expect to receive objects of type com.yourapp.OrderEvent, set the allow-list to "com.yourapp". This switches ObjectInputStreamWithClassLoader from "allow everything" to "deny by default, allow only listed classes." With this in place, even if an attacker injects a malicious ObjectMessage through any vector, the deserialization of gadget chain classes is blocked.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
