Which versions of Java are affected by CVE-2026-33728?

DataDog's dd-trace-java agent versions before 1.60.3 contain a critical remote code execution vulnerability affecting organizations running Java applications on JDK 16 or earlier with exposed JMX/RMI…. A patch is available.

How to fix or mitigate CVE-2026-33728?

Within 24 hours: Identify all systems running dd-trace-java agent versions prior to 1.60.3, prioritize those with JDK 16 or earlier and exposed JMX/RMI ports, and isolate or restrict network access to these ports. Within 7 days: Upgrade all affected dd-trace-java agent instances to version 1.60.3 or later, beginning with production environments. Within 30 days: Conduct post-patch verification and audit gadget-chain library dependencies on upgraded systems to eliminate attack surface.

Java CVE-2026-33728

Q: What is the CVSS score of CVE-2026-33728?

CVE-2026-33728 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-03-26 https://github.com/DataDog/dd-trace-java

GHSA-579q-h82j-r5v2

RCE Java Deserialization

9.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 26, 2026 - 16:45 vuln.today

CVE Published

Mar 26, 2026 - 16:45 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

In versions of dd-trace-java prior to 1.60.3, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability:

dd-trace-java is attached as a Java agent (-javaagent) on Java 16 or earlier
A JMX/RMI port has been explicitly configured via -Dcom.sun.management.jmxremote.port and is network-reachable
A gadget-chain-compatible library is present on the classpath

Impact

Arbitrary remote code execution with the privileges of the user running the instrumented JVM.

Recommendation

For JDK >= 17: No action is required, but upgrading is strongly encouraged.
For JDK >= 8u121 < JDK 17: Upgrade to dd-trace-java version 1.60.3 or later.
For JDK < 8u121 and earlier where serialization filters are not available, apply the workaround described below.

Workarounds

Set the following environment variable to disable the RMI integration: DD_INTEGRATION_RMI_ENABLED=false

Credits

This vulnerability was responsibly disclosed by Mohamed Amine ait Ouchebou (mrecho) (Indiesecurity) via the Datadog bug bounty program.

AnalysisAI

Remote code execution is possible in DataDog's dd-trace-java agent versions prior to 1.60.3 when running on JDK 16 or earlier with exposed JMX/RMI ports. The vulnerability stems from unsafe deserialization in the RMI instrumentation's custom endpoint, allowing network-accessible attackers to execute arbitrary code if gadget-chain libraries exist on the classpath. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Connect to exposed JMX/RMI port

Delivery

Send malicious serialized Java object

Exploit

RMI endpoint deserializes without filters

Execution

Gadget chain executes arbitrary code

Impact

Remote code execution as JVM process

Access

Connect to exposed JMX/RMI port

Delivery

Send malicious serialized Java object

Exploit

RMI endpoint deserializes without filters

Execution

Gadget chain executes arbitrary code

Impact

Remote code execution as JVM process

Vulnerability AssessmentAI

Exploitation	Requires dd-trace-java versions prior to 1.60.3 attached as Java agent (-javaagent) on Java 16 or earlier with JMX/RMI port explicitly configured via -Dcom.sun.management.jmxremote.port. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Real-world risk is constrained by three mandatory preconditions: the agent must run on JDK 16 or earlier (increasingly uncommon in production), JMX/RMI ports must be explicitly configured and network-reachable (typically disabled or firewalled in secure deployments), and exploitable gadget-chain libraries must exist on the classpath. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with network access to an exposed JMX port (typically TCP 9010 or similar) on a server running dd-trace-java prior to 1.60.3 on JDK 16 crafts a malicious serialized Java object containing a gadget chain leveraging libraries like Apache Commons Collections present in the application classpath. When the attacker sends this payload to the vulnerable RMI endpoint registered by the dd-trace-java agent, the unsafe deserialization process executes the gadget chain, allowing the attacker to run arbitrary commands with the privileges of the JVM process, potentially achieving full system compromise depending on the service account permissions.
Remediation	Upgrade dd-trace-java to version 1.60.3 or later, as documented in the vendor advisory at https://github.com/DataDog/dd-trace-java/security/advisories/GHSA-579q-h82j-r5v2 and release announcement at https://github.com/DataDog/dd-trace-java/releases/tag/v1.60.3. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all systems running dd-trace-java agent versions prior to 1.60.3, prioritize those with JDK 16 or earlier and exposed JMX/RMI ports, and isolate or restrict network access to these ports. …

Threat intelligence, references, and detailed analysis are available after sign-in.