CVE-2026-86404 Arbitrary Deserialization in Red Hat JBoss EAP

Red Hat JBoss Enterprise Application Platform (EAP) is affected by a critical deserialization vulnerability in its Artemis messaging component (CVE-2026-86404). The flaw resides within the ObjectMessage.getObject() method, which utilizes the ObjectInputStreamWithClassLoader class for deserialization. In default configurations, both the allow-list and block-list filters within the class remain empty.

The security logic implemented in checkSecurity() and isTrustedType() defaults to a permissive state when the allow-list size is zero, effectively trusting all incoming serialized classes. An unauthenticated attacker capable of sending serialized objects to the Artemis component can leverage this configuration to instantiate arbitrary classes, leading to remote code execution (RCE) in the context of the application server. This vulnerability highlights the risks associated with insecure deserialization patterns in Java-based middleware and requires immediate configuration review or patching.

Impact

Successful exploitation of CVE-2026-86404 allows an attacker to achieve remote code execution on the application server hosting the JBoss EAP instance. This may lead to full system compromise, data exfiltration, or lateral movement within the network. The scope of targeting includes any environment utilizing default configurations of the affected Artemis component in EAP.

Recommendation

• Review JBoss EAP configuration files to identify and harden the Artemis messaging component.
• Implement strict allow-listing for deserialization filters as recommended by Red Hat to replace the default permissive behavior.
• Monitor application server logs for abnormal java.io.ObjectInputStream activity or unexpected class loading attempts.
• Patch the JBoss EAP instances to the latest vendor-supplied version containing the security update for CVE-2026-86404.