CVE-2026-6857: Camel-infinispan: camel-infinispan: remote code execution via unsafe deserialization

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-22 · updated 2026-10-26
Weakness: CWE-502

Description

A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.

Affected products

Red Hat build of Apache Camel 4 for Quarkus 3: all versions
Red Hat Fuse 7: all versions

References

https://access.redhat.com/errata/RHSA-2026:17668
https://access.redhat.com/errata/RHSA-2026:22453
https://access.redhat.com/security/cve/CVE-2026-6857
https://bugzilla.redhat.com/show_bug.cgi?id=2460003
https://access.redhat.com/errata/RHSA-2026:17668
https://access.redhat.com/errata/RHSA-2026:22453
https://access.redhat.com/security/cve/CVE-2026-6857
https://bugzilla.redhat.com/show_bug.cgi?id=2460003
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6857.json

Get alerted when CVE-2026-6857 or the next vulnerability affects your stack