Hazelcast CVE-2026-107726

The attacker must be able to establish a client connection to a Hazelcast cluster member (i.e., have network reachability to the member's listening port). In default Community Edition deployments where Hazelcast Security and client authorization are not enabled, any reachable client can connect without authentication; where client authorization is enforced, a low-privileged client credential is required. The arbitrary-read and crash (DoS) impacts affect both slim and full distributions of Community and Enterprise Editions; the memory-corruption-to-RCE impact is limited to 'some Hazelcast Enterprise Edition configurations.' The patch introduces/strengthens a zero-config Compact serialization class filter (zero-config-filter allowlist/blacklist), indicating that unrestricted zero-config Compact serialization is a relevant exposure. Limiting factors that reduce real-world risk: firewalling member ports from untrusted networks, enforcing client authorization, and defining an explicit zero-config Compact serialization allowlist - all recommended in the vendor hardening guide.

This is a genuine high-priority vulnerability, not an inflated CVSS score. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3 Critical) describes a network-reachable, low-complexity flaw with high confidentiality, integrity, and availability impact and no user interaction. The impact is well-substantiated by the GHSA advisory: arbitrary reads of a member's Java heap, off-heap data, and JVM process address space (confidentiality), member crashes (availability/DoS), and, in some Enterprise Edition configurations, memory corruption leading to possible RCE (integrity). A notable signal conflict exists: the official vector states PR:N (unauthenticated), yet both the NVD description and GHSA advisory repeatedly characterize the attacker as a 'low-privileged malicious client able to connect to a cluster' - implying at least the ability to establish a client connection, which in hardened deployments requires authorization. This should be verified against your deployment: in default Community Edition (no security enabled) PR:N is realistic, but where Hazelcast Security and client authorization are enforced, the practical barrier is higher (PR:L). No EPSS score, no CISA KEV listing, and no public exploit (POC) were provided, so there is no evidence of active exploitation - the urgency is driven by impact severity and patch availability rather than observed in-the-wild activity. Net: treat as a priority patch for any cluster whose member ports are reachable by untrusted or semi-trusted clients.

A malicious or compromised client that can reach a Hazelcast cluster member's listening port connects and sends crafted, improperly-validated serialized data. The server-side flaw lets the attacker read arbitrary regions of the member's heap, off-heap store, and JVM address space (exfiltrating secrets and other tenants' data) and crash members for denial of service; in some Enterprise Edition configurations it can corrupt memory for possible remote code execution. No public exploit code was identified at time of analysis.