VulnSocial

CVE-2026-86404Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked 2d ago at 1 mentions (2026-09-08); latest day: 1
  • 3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-09-08: 1Mentions · 2026-09-09: 1Mentions · 2026-09-12: 1Patch / Workaround · 2026-09-08: 1Technical Details · 2026-09-08: 1Technical Details · 2026-09-09: 1Technical Details · 2026-09-12: 109-0809-0909-12
Signal classification1 categories
Disclosure
3100.0%
Full discourse3 posts
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨HIGH - Red Hat EAP Artemis ObjectMessage Unsafe Deserialization Default (CVE-2026-86404) In Red Hat EAP’s Artemis messaging, the deserialization trust check allows any class when both allow-list and block-list are empty, so untrusted ObjectMessage payloads deserialize by default. Remote attackers can trigger gadget chains leading to RCE unless a restrictive allow-list is configured. 👉Affected: Red Hat EAP Artemis (artemis-server, artemis-core-client, artemis-jms-client, undertow-core, wildfly-messaging-activemq-subsystem)

    Post summary

    The post discloses a high‑severity Red Hat EAP Artemis vulnerability (CVE‑2026‑86404) that permits default unsafe deserialization, explains technical details, and recommends configuring a restrictive allow‑list as a mitigation, but does not provide PoC, exploit code, or evidence of active exploitation.

    0001091
    303 followersView on X
  • DFIR Lab@DFIR_Lab
    Disclosure

    🚨 HIGH SEVERITY: CVE-2026-86404 | CVSS 8.8 EAP Artemis deserialization flaw allows unrestricted object deserialization by default. Empty allow-lists permit ALL classes to be deserialized. Impact: RCE potential CWE-502 #CVE #Vulnerability #PatchNow https://t.co/b3jKWRSHPp

    Post summary

    The tweet announces CVE-2026-86404, a deserialization flaw in EAP Artemis that allows RCE with a CVSS of 8.8, but does not provide PoC, exploitation details, or patch information.

    0000044
    133 followersView on X
  • DFIR Lab@DFIR_Lab
    Disclosure

    🚨 HIGH: CVE-2026-86404 (CVSS 8.8) EAP Artemis deserialization flaw allows ALL classes to deserialize by default due to empty allow-list. CWE-502. Network exploitable with low privileges. #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/WOETR8beiD

    Post summary

    The tweet announces CVE‑2026‑86404, an EAP Artemis deserialization vulnerability with CVSS 8.8 that permits any class deserialization due to an empty allow‑list and is network‑exploitable with low privileges.

    0000026
    129 followersView on X

Explore more

Back to dashboard