Search: CVE-2026-86404

CVE-2026-86404 is a high severity vulnerability in Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 involving insecure deserialization. The Artemis messaging component permits deserialization of all classes by default due to empty allow-list and block-list configurations. This allows potentially unsafe objects to be deserialized, leading to high impact on confidentiality, integrity, and availability. A security update is available in Red Hat JBoss Enterprise Application Platform 7.4.25 that addresses this and other vulnerabilities.