CVE-2026-86404: Deserialization of Untrusted Data in Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8

The vulnerability arises because Artemis deserialization configuration in Red Hat JBoss EAP 7.4 permits deserialization by default. The ObjectMessage.getObject() method uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via checkSecurity()/isTrustedType(). However, when the allow-list is empty (size == 0), isTrustedType() returns true for all classes, effectively allowing deserialization of any class. This can lead to remote code execution or other severe impacts. Red Hat has released a security update (7.4.25) that includes fixes for this and other issues.

Successful exploitation can lead to arbitrary code execution or other severe impacts on confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 8.8 (high severity) with network attack vector, low attack complexity, and privileges required. The vulnerability affects the deserialization mechanism in Artemis messaging, potentially allowing attackers to deserialize untrusted data.

A security update is available in Red Hat JBoss Enterprise Application Platform 7.4.25 that addresses this vulnerability. Users should apply this official patch from Red Hat promptly. Refer to the Red Hat advisory RHSA-2026:53644 for detailed update instructions. No alternative mitigations are specified by the vendor.