CVE-2026-86404 Red Hat CVE debrief

Who should care

Defenders responsible for Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 deployments should assess exposure and prioritize remediation. This includes reviewing the current deserialization configuration and class loading practices, and verifying the allow-list and block-list configuration for ObjectInputStreamWithClassLoader. Defenders should also monitor for potential exploitation attempts and review compensating controls for exposed

Why it matters

CVE-2026-86404 is a deserialization vulnerability in Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7. Defenders should assess exposure, verify deserialization configurations, and prioritize remediation to prevent potential code execution and data breaches.

• Potential for arbitrary code execution upon deserialization of untrusted data
• Need for verification of current deserialization configuration and class loading practices
• Possible data breaches or system compromise if exploited
• Priority for updating and securing deserialization allow-lists and block-lists

Technical summary

The EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default. The vulnerability has a CVSS score of 8.8 and is considered HIGH severity.

Defensive priority

High

Recommended defensive actions

• Review and update the deserialization configuration in EAP's Artemis setup
• Apply Red Hat errata RHSA-2026:53644, RHSA-2026:53645, RHSA-2026:53646, RHSA-2026:53806, RHSA-2026:70228, RHSA-2026:70229, RHSA-2026:70230, and RHSA-2026:70277
• Verify the allow-list and block-list configuration for ObjectInputStreamWithClassLoader
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Red Hat has released several errata related to this issue. The vulnerability has been publicly disclosed and defenders should verify the allow-list and block-list configuration for ObjectInputStreamWithClassLoader. There is no evidence of exploitation in the wild, but defenders should monitor for potential exploitation attempts. The CVE record provides additional information on the vulnerability, including its CVSS score and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.