CVE-2021-40865

—

CVSS 3.1

9.8 critical

EPSS

66%p99

Published

Oct 25, 2021 (Oct 25, 2021)

Modified

Jun 17, 2026

Description

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4

Vendors: apache
Products: storm
Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (65.6%)

In the news0 stories

No ingested article mentions this CVE yet.