Red Hat EAP Artemis deserialization allows all classes by default
CVE-2026-86404 Published on September 7, 2026
Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in red hat eap permit deserialization by default
EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.
Vulnerability Analysis
CVE-2026-86404 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Timeline
Reported to Red Hat.
Made public. 88 days later.
Weakness Type
What is a Marshaling, Unmarshaling Vulnerability?
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVE-2026-86404 has been classified to as a Marshaling, Unmarshaling vulnerability or weakness.
Products Associated with CVE-2026-86404
Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.
Affected Versions
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:- Version 0:2.16.0-22.redhat_00057.1.el7eap and below * is unaffected.
- Version 0:2.3.14-11.SP11_redhat_00001.1.el7eap and below * is unaffected.
- Version 0:1.5.26-2.Final_redhat_00001.1.el7eap and below * is unaffected.
- Version 0:2.18.8-1.redhat_00003.1.el7eap and below * is unaffected.
- Version 0:2.18.8-1.redhat_00003.1.el7eap and below * is unaffected.
- Version 0:2.18.8-1.redhat_00003.1.el7eap and below * is unaffected.
- Version 0:2.18.8-1.redhat_00003.1.el7eap and below * is unaffected.
- Version 0:2.18.8-1.redhat_00003.1.el7eap and below * is unaffected.
- Version 0:2.18.8-1.redhat_00003.1.el7eap and below * is unaffected.
- Version 0:5.0.31-3.SP2_redhat_00001.1.el7eap and below * is unaffected.
- Version 0:1.10.0-46.Final_redhat_00044.1.el7eap and below * is unaffected.
- Version 0:4.1.135-1.Final_redhat_00001.1.el7eap and below * is unaffected.
- Version 0:4.1.135-1.Final_redhat_00001.1.el7eap and below * is unaffected.
- Version 0:2.5.5-30.SP12_redhat_00020.1.el7eap and below * is unaffected.
- Version 0:2.5.5-24.SP12_redhat_00016.1.el7eap and below * is unaffected.
- Version 0:2.2.40-2.SP3_redhat_00001.1.el7eap and below * is unaffected.
- Version 0:7.4.25-2.GA_redhat_00001.1.el7eap and below * is unaffected.