CVE-2026-47065Disclosure(apache / mina)

MEDIUMCVSS 9.8 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch apache mina systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.readProxyDesc() is dispatched. JDK then calls the default ObjectInputStream.resolveProxyClass(interfaces) implementation, which performs Class.forName(intf, false, latestUserDefinedLoader()) for EACH interface name and constructs the proxy class â€” bypassing the accepted classes list . ZDRES-233: Class.forName(name, initialize=true, classLoader) in readClassDescriptor Triggers Static Initialiser of Allow-Listed Classes Assessment: Fully addressed. For ANY class on the allow-list, deserialising a stream that names it triggers the class’s (static initialiser) BEFORE any instance is constructed. This means an attacker who supplies a class name on the allow-list (e.g., the developer wrote accept(“com.myapp.*") , attacker supplies com.myapp.SomeClass ) causes <clinit> of SomeClass â€” and many real-world classes have side-effecting static initialisers Both issues have been fixed.

apache CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj

Weakness type (CWE)

CWE-502

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

mina

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
7 mentions across 6 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 5 signals
Disclosure: 5 classified signals
Peaked 1d ago at 2 mentions (2026-09-22); latest day: 1
7 total mentions across 6 days

Affected systems

Vendors

apache

Products

mina

3 versions affected across 1 product

Deep dive

Activity timeline7 mentions / 6d

Signal classification3 categories

Disclosure

571.4%

Active Exploitation

114.3%

Patch

114.3%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-03	1	Disclosure1
2026-06-04	1	Active Exploitation1
2026-06-09	1	Patch1
2026-09-21	1	Disclosure1
2026-09-22	2	Disclosure2
2026-10-04	1	Disclosure1

Full discourse7 posts

Upwind Security MDR@UpwindMDR27d
Disclosure
🚨Critical - Apache MINA Java Proxy Allow-list Bypass Regression (CVE-2026-94301) Apache MINA 2.0.x/2.1.x missed the resolveProxyClass() override that was only applied in 2.2.x for CVE-2026-47065. Attackers can bypass the deserialization allow-list by leveraging java.lang.reflect.Proxy during class resolution, enabling gadget invocation and potential RCE. MINA 2.2.x is not affected. 👉Affected: Apache MINA 2.0.0-2.0.30, 2.1.0-2.1.14
Post summary
The text announces a critical regression vulnerability in Apache MINA (CVE-2026-94301) affecting versions 2.0.x and 2.1.x, providing technical details on how the deserialization allow-list can be bypassed to achieve potential RCE.
1001095
310 followersView on X
ExploitGrid@exploitgrid26d
Disclosure
[CVE] CVE-2026-94301 [HIGH PRIORITY] #Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.... 🔗 https://exploitgrid.net/cve/CVE-2026-94301
Post summary
The tweet references CVE-2026-94301 and notes that the resolveProxyClass fix for CVE-2026-47065 is missing from Apache MINA 2.0.X and 2.1, providing a CVE link but no explicit PoC, exploit, patch, or active exploitation details.
1000032
203 followersView on X
DFIR Lab@DFIR_Lab14d
Disclosure
🚨 CRITICAL: CVE-2026-94301 (CVSS 9.8) Apache MINA 2.0.X & 2.1.X remain vulnerable to deserialization bypass. Previous fix (CVE-2026-47065) was incomplete—only applied to 2.2.X branch. Versions 2.0.29-2.0.30 & 2.1.13-2.1.14 affected. #CVE #PatchNow https://t.co/01euuoGBVd
Post summary
The tweet discloses CVE-2026-94301 in Apache MINA, citing CVSS 9.8, deserialization bypass, affected versions, and an incomplete prior fix, without mentioning a PoC, exploit, or active exploitation.
0000047
146 followersView on X
SecAlerts@SecAlertsCo27d
Disclosure
⚠️ Apache MINA: the CVE-2026-47065 fix (acceptMatchers filter bypass via java.lang.reflect.Proxy) was never backported to 2.0.30 or 2.1.14. CVE-2026-94301, CVSS 9.8. Still on those branches? You're exposed. #cybersecurity #ciso #vulnerabilities https://secalerts.co/vulnerability/CVE-2026-94301?utm_campaign=x https://t.co/UVgY9i3RqU
Post summary
Tweet announces CVE-2026-94301 (CVSS 9.8) in Apache MINA with technical bypass details and states the CVE-2026-47065 fix was not backported to older branches.
0000068
890 followersView on X
SecAlerts@SecAlertsCo131d
Patch
Apache MINA hit with a critical deserialization flaw. CVE-2026-47065 (CVSS 9.8) lets attackers bypass the acceptMatchers filter via java.lang.reflect.Proxy, fully unauthenticated. Patch now. #Apache #AppSec https://secalerts.co/vulnerability/CVE-2026-47065
Post summary
The post announces a critical deserialization flaw (CVE-2026-47065) in Apache MINA with a CVSS 9.8 score and notes that a patch is available, but does not mention active exploitation or provide a PoC.
0000067
832 followersView on X
VulDB 🛡@vuldb136d
Active Exploitation
It is possible to see elevated activities targeting Apache MINA (CVE-2026-47065) https://vuldb.com/vuln/368097/cti
Post summary
The post indicates that elevated activity targeting Apache MINA (CVE‑2026‑47065) is observed in the wild, but no PoC, exploit, patch or technical details are shared.
0000056
2.2K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds137d
Disclosure
CVE-2026-47065 Java Deserialization Filter Bypass via Proxy Class Resolution and Static Initializer Execution https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-47065
Post summary
The text announces CVE-2026-47065, describing a Java deserialization filter bypass that exploits proxy class resolution and static initializer execution.
0000057
4.0K followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	mina	2.0.29	-	-
App	apache	mina	2.1.13	-	-
App	apache	mina	2.2.8	-	-

Explore more

Back to dashboard apache CVEs mina vulnerabilities

What researchers are saying

CVE-2026-47065

Upwind Security MDR[verified]@UpwindMDRDisclosure

The text announces a critical regression vulnerability in Apache MINA (CVE-2026-94301) affecting versions 2.0.x and 2.1.x, providing technical details on how the deserialization allow-list can be bypassed to achieve potential RCE.

DFIR Lab[verified]@DFIR_LabDisclosure

The tweet discloses CVE-2026-94301 in Apache MINA, citing CVSS 9.8, deserialization bypass, affected versions, and an incomplete prior fix, without mentioning a PoC, exploit, or active exploitation.

ExploitGrid@exploitgridDisclosure

The tweet references CVE-2026-94301 and notes that the resolveProxyClass fix for CVE-2026-47065 is missing from Apache MINA 2.0.X and 2.1, providing a CVE link but no explicit PoC, exploit, patch, or active exploitation details.

SecAlerts@SecAlertsCoDisclosure

Tweet announces CVE-2026-94301 (CVSS 9.8) in Apache MINA with technical bypass details and states the CVE-2026-47065 fix was not backported to older branches.

SecAlerts@SecAlertsCoPatch

The post announces a critical deserialization flaw (CVE-2026-47065) in Apache MINA with a CVSS 9.8 score and notes that a patch is available, but does not mention active exploitation or provide a PoC.

VulDB 🛡@vuldbActive Exploitation

The post indicates that elevated activity targeting Apache MINA (CVE‑2026‑47065) is observed in the wild, but no PoC, exploit, patch or technical details are shared.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text announces CVE-2026-47065, describing a Java deserialization filter bypass that exploits proxy class resolution and static initializer execution.