CVE-2020-26217: Apache ActiveMQ
High severity, CVSS 8.8. EPSS: 85% chance of exploitation in the next 30 days.
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
Affected products
- Apache ActiveMQ: before 5.15.14 (fixed in 5.15.14); version 5.16.0 only
- Debian Debian Linux: version 9.0 only; version 10.0 only
- Netapp Snapmanager: any version; affected versions not specified
- Oracle Banking Cash Management: version 14.2 only; version 14.3 only; version 14.5 only
- Oracle Banking Corporate Lending Process Management: version 14.2 only; version 14.3 only; version 14.5 only
- Oracle Banking Credit Facilities Process Management: version 14.2 only; version 14.3 only; version 14.5 only
- Oracle Banking Platform: version 2.4.0 only; version 2.7.1 only; version 2.9.0 only
- Oracle Banking Supply Chain Finance: version 14.2 only; version 14.3 only; version 14.5 only
- Oracle Banking Trade Finance Process Management: version 14.2 only; version 14.3 only; version 14.5 only
- Oracle Banking Virtual Account Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
- Oracle Business Activity Monitoring: version 11.1.1.9.0 only; version 12.2.1.3.0 only; version 12.2.1.4.0 only
- Oracle Communications Policy Management: version 12.5.0 only
- Oracle Endeca Information Discovery Studio: version 3.2.0.0 only
- Oracle Retail Xstore Point Of Service: version 16.0.6 only; version 17.0.4 only; version 18.0.3 only; version 19.0.2 only
- XStream XStream: before 1.4.14 (fixed in 1.4.14)
Published 2020-11-16. Last modified 2026-10-07.