CVE-2026-86404: Deserialization of Untrusted Data in Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25

The Artemis deserialization configuration in Red Hat JBoss Enterprise Application Platform 7.4.25 permits deserialization by default because the allow-list and block-list used by ObjectInputStreamWithClassLoader are empty. When the allow-list is empty, the isTrustedType() method returns true for all classes, allowing any class to be deserialized. This behavior can enable attackers to inject malicious ObjectMessage instances that trigger deserialization of arbitrary classes, potentially leading to data modification, denial of service, or other impacts depending on the deserialized objects and methods invoked.

The vulnerability allows an attacker with low privileges and no user interaction to send malicious serialized objects over the network, which are deserialized without restriction. This can result in high confidentiality, integrity, and availability impacts, including modification of application data, unexpected application states, and resource exhaustion leading to denial of service.

Red Hat advises configuring a restrictive deserialization allow-list on every pooled-connection-factory resource. For example, if message-driven beans only expect objects of type com.yourapp.OrderEvent, the allow-list should be set to "com.yourapp". This changes the default behavior from allowing all classes to denying all except those explicitly listed, blocking deserialization of malicious gadget chain classes. No official patch is mentioned; mitigation relies on configuration changes.