CVE-2026-6857: Insecure Deserialization Vulnerability (CVSS 7.5)

Description

A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.67%

50.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
—	—	>= 4.0.0, < 4.14.7; >= 4.15.0, < 4.18.2; >= 4.19.0, < 4.20.0
Red Hat	Red Hat build of Apache Camel 4 for Quarkus 3	All versions
Red Hat	Red Hat Fuse 7	All versions

References

Timeline

Published: Apr 22, 2026
Last Modified: Sep 23, 2026
Status: Awaiting Analysis

Frequently Asked Questions

What is CVE-2026-6857?

A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.

How severe is CVE-2026-6857?

CVE-2026-6857 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 0.67% probability of exploitation in the next 30 days.

How do I fix CVE-2026-6857?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →