What’s Vulnerable › Vulnerabilities

CVE-2020-26217: Remote Code Execution in XStream

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 82.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-11-16 · updated 2026-10-07
• Weakness: CWE-78

Description

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.

Affected products

• Apache ActiveMQ: before 5.15.14; 5.16.0 — fixed in 5.15.14
• Debian Linux: 9.0, 10.0
• SnapManager for Oracle: all versions
• Oracle Banking Cash Management: 14.2, 14.3, 14.5
• Oracle Banking Corporate Lending Process Management: 14.2, 14.3, 14.5
• Oracle Banking Credit Facilities Process Management: 14.2, 14.3, 14.5
• Oracle Banking Platform: 2.4.0, 2.7.1, 2.9.0
• Oracle Banking Supply Chain Finance: 14.2, 14.3, 14.5
• Oracle Corporation Oracle Banking Trade Finance Process Management: 14.2, 14.3, 14.5
• Oracle Corporation Banking Virtual Account Management: 14.2.0, 14.3.0, 14.5.0
• Oracle Business Activity Monitoring: 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
• Oracle Corporation Communications Policy Management: 12.5.0
• Oracle Endeca Information Discovery Studio: 3.2.0.0
• Oracle Corporation Retail Xstore Point of Service: 16.0.6, 17.0.4, 18.0.3, 19.0.2
• x-stream xstream: before 1.4.14 — fixed in 1.4.14

How to fix

Upgrade to a fixed version: Apache ActiveMQ 5.15.14; x-stream xstream 1.4.14. Check the vendor advisory for mitigations.

References

• https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a
• https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2
• https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e%40%3Cissues.activemq.apache.org%3E
• https://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9%40%3Ccommits.camel.apache.org%3E
• https://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c%40%3Cissues.activemq.apache.org%3E
• https://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3%40%3Cissues.activemq.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2020/12/msg00001.html
• https://security.netapp.com/advisory/ntap-20210409-0004/
• https://www.debian.org/security/2020/dsa-4811
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpuapr2022.html

Get alerted when CVE-2020-26217 or the next vulnerability affects your stack