CVE-2026-107725: Hazelcast

High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days.

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.

Affected products

• Hazelcast Hazelcast: before 5.4.5 (fixed in 5.4.5); from 5.5.0, before 5.5.10 (fixed in 5.5.10); from 5.6.0, before 5.6.1 (fixed in 5.6.1)

Published 2026-10-08. Last modified 2026-10-09.