NetSight
IP …
high8.8

CVE-2026-86404

EAP's Artemis deserialization configuration permits deserialization by default.

Impact

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.

Affected products

VendorProductAffected versions
Red HatRed Hat JBoss Enterprise Application Platform 8.1 For RHEL 10
Versions patch: 0:2.25.4-1.redhat_00003.1.el10eap, patch: 0:5.1.0-1.Final_redhat_00001.1.el10eap, patch: 0:2.6.11-1.Final_redhat_00001.1.el10eap, patch: 0:3.1.0-1.Final_redhat_00001.1.el10eap, patch: 0:2.18.9-1.redhat_00003.1.el10eap, patch: 0:2.2.0-1.Final_redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 For RHEL 9
Versions patch: 0:2.40.0-8.redhat_00024.1.el9eap, patch: 0:2.2.0-1.Final_redhat_00001.1.el9eap, patch: 0:1.85.0-1.redhat_00001.1.el9eap, patch: 0:2.3.2-1.redhat_00001.1.el9eap, patch: 0:2.1.0-1.redhat_00001.1.el9eap, patch: 0:3.0.1-1.Final_redhat_00001.1el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 For RHEL 8
Versions patch: 0:3.0.1-1.Final_redhat_00001.1.el8eap, patch: 0:5.1.0-1.Final_redhat_00001.1.el8eap, patch: 0:4.0.5-1.redhat_00001.1.el8eap, patch: 0:2.2.0-1.Final_redhat_00001.1.el8eap, patch: 0:2.25.4-1.redhat_00003.1.el8eap, patch: 0:8.1.8-9.GA_redhat_00006.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1.8.GA
Version patch: 2.40.0.redhat-00024

Weakness classification

CWE-502

References