CVE-2026-41862 affects Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis, and ZooKeeper) in versions 3.2.0 through 3.2.4 and 4.0.0 through 4.0.1. These backends deserialize persisted state-machine contexts without enforcing a class allowlist, leading to deserialization of untrusted data (CWE-502). This flaw can enable remote code execution inside the JVM running the application. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with at least low privileges to cause remote code execution within the application JVM by exploiting unsafe deserialization of persisted state-machine contexts. This can lead to full compromise of the affected application environment, including confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting use of Kryo-based persistence backends in Spring Statemachine or applying custom deserialization allowlists if feasible. Monitor vendor channels for updates.