Which versions of Java are affected by CVE-2026-33728?

DataDog's dd-trace-java agent versions before 1.60.3 contain a critical remote code execution vulnerability affecting organizations running Java applications on JDK 16 or earlier with exposed JMX/RMI…. A patch is available.

How to fix or mitigate CVE-2026-33728?

Within 24 hours: Identify all systems running dd-trace-java agent versions prior to 1.60.3, prioritize those with JDK 16 or earlier and exposed JMX/RMI ports, and isolate or restrict network access to these ports. Within 7 days: Upgrade all affected dd-trace-java agent instances to version 1.60.3 or later, beginning with production environments. Within 30 days: Conduct post-patch verification and audit gadget-chain library dependencies on upgraded systems to eliminate attack surface.

Java CVE-2026-33728

Q: What is the CVSS score of CVE-2026-33728?

CVE-2026-33728 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-03-26 https://github.com/DataDog/dd-trace-java

GHSA-579q-h82j-r5v2

RCE Java Deserialization

9.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 26, 2026 - 16:45 vuln.today

CVE Published

Mar 26, 2026 - 16:45 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

In versions of dd-trace-java prior to 1.60.3, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability:

dd-trace-java is attached as a Java agent (-javaagent) on Java 16 or earlier
A JMX/RMI port has been explicitly configured via -Dcom.sun.management.jmxremote.port and is network-reachable
A gadget-chain-compatible library is present on the classpath

Impact

Arbitrary remote code execution with the privileges of the user running the instrumented JVM.

Recommendation

For JDK >= 17: No action is required, but upgrading is strongly encouraged.
For JDK >= 8u121 < JDK 17: Upgrade to dd-trace-java version 1.60.3 or later.
For JDK < 8u121 and earlier where serialization filters are not available, apply the workaround described below.

Workarounds

Set the following environment variable to disable the RMI integration: DD_INTEGRATION_RMI_ENABLED=false

Credits

This vulnerability was responsibly disclosed by Mohamed Amine ait Ouchebou (mrecho) (Indiesecurity) via the Datadog bug bounty program.

AnalysisAI

Remote code execution is possible in DataDog's dd-trace-java agent versions prior to 1.60.3 when running on JDK 16 or earlier with exposed JMX/RMI ports. The vulnerability stems from unsafe deserialization in the RMI instrumentation's custom endpoint, allowing network-accessible attackers to execute arbitrary code if gadget-chain libraries exist on the classpath. Vendor-released patch: version 1.60.3. No public exploit identified at time of analysis, though the issue was responsibly disclosed through DataDog's bug bounty program by Mohamed Amine ait Ouchebou.

Technical ContextAI

The affected product is com.datadoghq:dd-java-agent (CPE: pkg:maven/com.datadoghq:dd-java-agent), a distributed tracing library that instruments Java applications. The vulnerability (CWE-502: Deserialization of Untrusted Data) arises from the RMI instrumentation component registering a custom endpoint that deserializes incoming network data without applying serialization filters. Java's RMI (Remote Method Invocation) and JMX (Java Management Extensions) mechanisms allow remote method calls and management operations. When JMX remote monitoring is enabled via -Dcom.sun.management.jmxremote.port, the agent creates a network-accessible endpoint. Prior to JDK 8u121, Java lacked serialization filters; JDK 17+ enforces stricter deserialization protections by default. Exploitation requires gadget chains (sequences of existing classes that can be chained during deserialization to achieve code execution), commonly found in libraries like Apache Commons Collections or Spring Framework.

RemediationAI

Upgrade dd-trace-java to version 1.60.3 or later, as documented in the vendor advisory at https://github.com/DataDog/dd-trace-java/security/advisories/GHSA-579q-h82j-r5v2 and release announcement at https://github.com/DataDog/dd-trace-java/releases/tag/v1.60.3. Organizations running JDK 17 or later are protected by platform-level deserialization controls but should still upgrade to eliminate the vulnerable code path. For environments unable to immediately upgrade, set the environment variable DD_INTEGRATION_RMI_ENABLED=false to disable the vulnerable RMI integration. Additionally, restrict network access to JMX/RMI ports using firewall rules limiting connections to trusted management networks only, and review the classpath to remove unnecessary libraries that may contain deserialization gadget chains. Organizations on JDK versions prior to 8u121 should prioritize JDK upgrades alongside the dd-trace-java update.