CVE-2026-6857 is a deserialization of untrusted data vulnerability in the camel-infinispan component of the Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14. The flaw arises from unsafe deserialization in the ProtoStream remote aggregation repository, enabling a remote attacker with low privileges to send specially crafted data that triggers arbitrary code execution. This vulnerability has a CVSS v3.1 score of 7.5 (high severity) with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts confidentiality, integrity, and availability. Red Hat has published advisories (RHSA-2026:17668 and RHSA-2026:22453) announcing patch releases that fix this issue and related vulnerabilities in Apache Camel components.

Successful exploitation allows a remote attacker with low privileges to execute arbitrary code on the affected system, potentially gaining full control. This compromises the confidentiality, integrity, and availability of the system running the vulnerable Apache Camel build. The vulnerability can be triggered remotely without user interaction, making it a significant risk for exposed deployments.

Red Hat has released official security updates addressing CVE-2026-6857 as part of patch releases for the Red Hat build of Apache Camel 4.18.1 for Spring Boot. Users should apply these updates promptly. Before applying the update, back up existing installations, including applications, configuration files, and databases. Refer to the Red Hat advisories at https://access.redhat.com/security/cve/CVE-2026-6857 and https://access.redhat.com/errata/RHSA-2026:17668 for detailed remediation instructions. Patch status is confirmed as available via these official updates.