CVE-2026-86404 — Vulnerability intelligence
Red Hat — Red Hat JBoss Enterprise Application Platform 8.1.8.GA, Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10, Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8, Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9, Red Hat AMQ Broker 7, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8
Published:
- CVSS
- 8.8
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.