CVE-2026-86404

CVE-2026-86404 is a CWE-502 (deserialization of untrusted data) flaw in the ActiveMQ Artemis messaging component embedded in Red Hat JBoss Enterprise Application Platform (EAP). Artemis's ObjectMessage.getObject() path performs deserialization through ObjectInputStreamWithClassLoader, whose checkSecurity()/isTrustedType() filtering is inert by default because both the allow-list and block-list ship empty — and when the allow-list is empty (size == 0), isTrustedType() returns true for every class. An attacker with low-privilege access to the messaging endpoint can send a crafted ObjectMessage, and when the receiving application calls getObject() the broker will deserialize any class, potentially reaching gadget classes on the EAP classpath and yielding code execution with high confidentiality, integrity, and availability impact (CVSS 3.1: 8.8). Only EAP deployments that use Artemis/JMS ObjectMessage and have not explicitly configured a deserialization allow-list or block-list are affected. There is no known exploitation, public proof-of-concept, or KEV listing; EPSS currently estimates a 0.4% chance of exploitation within the next 30 days (38th percentile).

What to do: Inventory EAP hosts for use of the messaging-activemq subsystem and JMS ObjectMessage, and where used, configure an explicit deserialization allow-list (or block-list) for Artemis rather than relying on the empty defaults, while restricting messaging endpoints to trusted, least-privilege accounts. No fixed version is provided in the available data, so track Red Hat Security Advisories for CVE-2026-86404 and apply Red Hat's patched EAP packages when published. Prioritize any EAP host exposing Artemis remoting to semi-trusted networks given the high (8.8) severity score.