CVE-2026-86404: Red Hat Amq Broker 7

High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days.

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.

Affected products

  • Red Hat Red Hat Amq Broker 7
  • Red Hat Red Hat Build Of Apache Camel 4 For Quarkus 3
  • Red Hat Red Hat Build Of Apache Camel For Spring Boot 4
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25: before 2.16.0.redhat-00057 (fixed in 2.16.0.redhat-00057)
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 Els On Rhel 7: before 0:2.16.0-22.redhat_00057.1.el7eap (fixed in 0:2.16.0-22.redhat_00057.1.el7eap); before 0:2.3.14-11.SP11_redhat_00001.1.el7eap (fixed in 0:2.3.14-11.SP11_redhat_00001.1.el7eap); before 0:1.5.26-2.Final_redhat_00001.1.el7eap (fixed in 0:1.5.26-2.Final_redhat_00001.1.el7eap); before 0:2.18.8-1.redhat_00003.1.el7eap (fixed in 0:2.18.8-1.redhat_00003.1.el7eap); before 0:5.0.31-3.SP2_redhat_00001.1.el7eap (fixed in 0:5.0.31-3.SP2_redhat_00001.1.el7eap); before 0:1.10.0-46.Final_redhat_00044.1.el7eap (fixed in 0:1.10.0-46.Final_redhat_00044.1.el7eap); …
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 Els On Rhel 8: before 0:2.16.0-22.redhat_00057.1.el8eap (fixed in 0:2.16.0-22.redhat_00057.1.el8eap); before 0:2.3.14-11.SP11_redhat_00001.1.el8eap (fixed in 0:2.3.14-11.SP11_redhat_00001.1.el8eap); before 0:1.5.26-2.Final_redhat_00001.1.el8eap (fixed in 0:1.5.26-2.Final_redhat_00001.1.el8eap); before 0:2.18.8-1.redhat_00003.1.el8eap (fixed in 0:2.18.8-1.redhat_00003.1.el8eap); before 0:5.0.31-3.SP2_redhat_00001.1.el8eap (fixed in 0:5.0.31-3.SP2_redhat_00001.1.el8eap); before 0:1.10.0-46.Final_redhat_00044.1.el8eap (fixed in 0:1.10.0-46.Final_redhat_00044.1.el8eap); …
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 Els On Rhel 9: before 0:2.16.0-22.redhat_00057.1.el9eap (fixed in 0:2.16.0-22.redhat_00057.1.el9eap); before 0:2.3.14-11.SP11_redhat_00001.1.el9eap (fixed in 0:2.3.14-11.SP11_redhat_00001.1.el9eap); before 0:1.5.26-2.Final_redhat_00001.1.el9eap (fixed in 0:1.5.26-2.Final_redhat_00001.1.el9eap); before 0:2.18.8-1.redhat_00003.1.el9eap (fixed in 0:2.18.8-1.redhat_00003.1.el9eap); before 0:5.0.31-3.SP2_redhat_00001.1.el9eap (fixed in 0:5.0.31-3.SP2_redhat_00001.1.el9eap); before 0:1.10.0-46.Final_redhat_00044.1.el9eap (fixed in 0:1.10.0-46.Final_redhat_00044.1.el9eap); …
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 For Rhel 10: before 0:2.40.0-8.redhat_00024.1.el10eap (fixed in 0:2.40.0-8.redhat_00024.1.el10eap); before 0:4.1.7-1.SP1_redhat_00001.1.el10eap (fixed in 0:4.1.7-1.SP1_redhat_00001.1.el10eap); before 0:2.0.5-1.Final_redhat_00001.1.el10eap (fixed in 0:2.0.5-1.Final_redhat_00001.1.el10eap); before 0:1.85.0-1.redhat_00001.1.el10eap (fixed in 0:1.85.0-1.redhat_00001.1.el10eap); before 0:1.2.7-1.redhat_00002.1.el10eap (fixed in 0:1.2.7-1.redhat_00002.1.el10eap); before 0:801.8.0-1.GA_redhat_00001.1.el10eap (fixed in 0:801.8.0-1.GA_redhat_00001.1.el10eap); …
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 For Rhel 8: before 0:2.40.0-8.redhat_00024.1.el8eap (fixed in 0:2.40.0-8.redhat_00024.1.el8eap); before 0:4.1.7-1.SP1_redhat_00001.1.el8eap (fixed in 0:4.1.7-1.SP1_redhat_00001.1.el8eap); before 0:2.0.5-1.Final_redhat_00001.1.el8eap (fixed in 0:2.0.5-1.Final_redhat_00001.1.el8eap); before 0:1.85.0-1.redhat_00001.1.el8eap (fixed in 0:1.85.0-1.redhat_00001.1.el8eap); before 0:1.2.7-1.redhat_00002.1.el8eap (fixed in 0:1.2.7-1.redhat_00002.1.el8eap); before 0:801.8.0-1.GA_redhat_00001.1.el8eap (fixed in 0:801.8.0-1.GA_redhat_00001.1.el8eap); …
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 For Rhel 9: before 0:2.40.0-8.redhat_00024.1.el9eap (fixed in 0:2.40.0-8.redhat_00024.1.el9eap); before 0:4.1.7-1.SP1_redhat_00001.1.el9eap (fixed in 0:4.1.7-1.SP1_redhat_00001.1.el9eap); before 0:2.0.5-1.Final_redhat_00001.1.el9eap (fixed in 0:2.0.5-1.Final_redhat_00001.1.el9eap); before 0:1.85.0-1.redhat_00001.1.el9eap (fixed in 0:1.85.0-1.redhat_00001.1.el9eap); before 0:1.2.7-1.redhat_00002.1.el9eap (fixed in 0:1.2.7-1.redhat_00002.1.el9eap); before 0:801.8.0-1.GA_redhat_00001.1.el9eap (fixed in 0:801.8.0-1.GA_redhat_00001.1.el9eap); …

Published 2026-09-07. Last modified 2026-10-08.