The vulnerability CVE-2026-41862 affects Spring Statemachine's Kryo-based persistence backends used in JPA, MongoDB, Redis, and ZooKeeper. The issue arises because these backends deserialize persisted state-machine contexts without enforcing a class allowlist, which is a CWE-502 weakness (deserialization of untrusted data). This flaw can be exploited by an attacker with network access and low privileges to execute arbitrary code remotely within the JVM hosting the application. The affected versions are Spring Statemachine 3.2.0 through 3.2.4 and 4.0.0 through 4.0.1. No official patch or remediation guidance is currently provided in the vendor advisory or CVE data.

Successful exploitation of this vulnerability can lead to remote code execution with high confidentiality, integrity, and availability impact on the affected system. An attacker could run arbitrary code inside the JVM process, potentially compromising the entire application and underlying system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the use of Kryo-based persistence backends or applying custom deserialization filters if feasible. Monitor vendor channels for updates and apply patches promptly once released.