CVE-2026-86404

Name of the Vulnerable Software and Affected Versions Red Hat EAP Artemis (affected versions not specified)

Description Red Hat EAP Artemis contains a flaw where the deserialization configuration permits the deserialization of all classes by default. The ObjectMessage.getObject() function utilizes ObjectInputStreamWithClassLoader, which manages filtering through the checkSecurity() and isTrustedType() methods. Because both the allow-list and block-list are empty by default, the isTrustedType() method returns true for all classes, allowing untrusted ObjectMessage payloads to be deserialized. This can be exploited by remote attackers to trigger gadget chains, potentially leading to remote code execution (RCE).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Configure a restrictive allow-list for deserialization to prevent the processing of untrusted classes.