Affects Red Hat JBoss EAP's Artemis default deserialization setting; widely deployed enterprise middleware that could enable RCE across organizations.
CVE-2026-86404
Default deserialization in EAP Artemis allows arbitrary classes to be deserialized.
Is CVE-2026-86404 being exploited?
Not confirmed. CVE-2026-86404 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked. EPSS currently estimates a 0.45% probability of exploitation in the next 30 days.
How severe is CVE-2026-86404?
CVE-2026-86404 is rated High with a CVSS score of 8.8. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2026-86404?
Yes. A fix has been recorded for CVE-2026-86404. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2026-86404 affect?
CVE-2026-86404 affects Red Hat JBoss EAP (Artemis), Apache ActiveMQ Artemis, Java apps using EAP's Artemis default deserialization. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
What should I do about CVE-2026-86404?
Apply vendor patch immediately, enable allow-listing, and restrict Artemis access.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
Remote code execution via crafted ObjectMessage due to empty allow-list allowing all classes to be deserialized.
Immediate action required