The vulnerability CVE-2026-6857 affects the camel-infinispan component of the Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14. It is caused by unsafe deserialization of untrusted data in the ProtoStream remote aggregation repository. An attacker with low privileges can exploit this remotely by sending specially crafted data, resulting in arbitrary code execution and full system compromise. Red Hat has acknowledged this issue and released security advisories (RHSA-2026:17668 and RHSA-2026:22453) that include this fix among other security updates. The advisories indicate that a patch or update is available, though exact fixed versions are not explicitly stated in the input. The CVSS v3.1 base score is 7.5, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

Successful exploitation allows remote attackers with low privileges to execute arbitrary code on affected systems, leading to complete compromise of confidentiality, integrity, and availability. This can result in full control over the affected system, enabling attackers to manipulate data, disrupt services, or further penetrate the network.

Red Hat has released security advisories and updates addressing CVE-2026-6857. Users should apply the relevant security updates from Red Hat for the Red Hat build of Apache Camel 4.18.1 for Spring Boot as soon as possible. Before applying updates, ensure all previously released errata relevant to your system are applied and back up existing installations. Patch status is confirmed by Red Hat advisories; therefore, remediation is available through official updates. Check the Red Hat advisory URLs for detailed update instructions and download links.