This vulnerability arises from unsafe deserialization in the ProtoStream remote aggregation repository within the camel-infinispan component of Red Hat's build of Apache Camel 4 for Quarkus 3. An attacker with low privileges can exploit this remotely by sending specially crafted data, resulting in arbitrary code execution on the target system. The CVSS 3.1 score of 7.5 reflects a high-severity risk with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity. No patch or official remediation guidance is currently provided in the vendor advisory, which is the authoritative source for updates.

Successful exploitation allows an attacker to execute arbitrary code remotely with low privileges, potentially gaining full control over the affected system. This impacts the system's confidentiality, integrity, and availability, posing a critical risk to operations relying on the vulnerable component.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-6857 for current remediation guidance. Until an official fix is released, restrict access to the vulnerable service to trusted users only and consider disabling or isolating the affected component if feasible.