CVE-2016-10750: Hazelcast

High severity, CVSS 8.1. EPSS: 4% chance of exploitation in the next 30 days.

In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code.

Affected products

• Hazelcast Hazelcast: before 3.11 (fixed in 3.11)

Published 2019-05-22. Last modified 2026-06-17.