Which versions of Java are affected by CVE-2026-4860?

A critical remote code execution vulnerability affecting wvp-GB28181-pro video streaming platforms (versions ≤2.7.4) is actively exploitable without authentication, with public exploit code now…

Is there a public PoC exploit available for CVE-2026-4860?

Yes, a public proof-of-concept exploit is available for CVE-2026-4860. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4860?

Within 24 hours: Inventory all systems running wvp-GB28181-pro and immediately isolate affected instances from production networks or disable external API access; establish incident response readiness. Within 7 days: Implement network segmentation restricting API endpoint access to trusted sources only, deploy WAF rules blocking malicious deserialization payloads, and monitor logs for exploitation attempts. Within 30 days: Evaluate alternative vendors or forked versions with security patches; if continued use is necessary, establish a vendor communication escalation with legal/procurement to demand patch timeline or prepare migration strategy.

Java CVE-2026-4860

Q: What is the CVSS score of CVE-2026-4860?

CVE-2026-4860 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16145 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-03-26 VulDB

GHSA-jxxw-582j-5377

Java Redis Deserialization

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 08:45 euvd

EUVD-2026-16145

Analysis Generated

Mar 26, 2026 - 08:45 vuln.today

CVE Published

Mar 26, 2026 - 08:18 nvd

MEDIUM 6.9

DescriptionCVE.org

A security flaw has been discovered in 648540858 wvp-GB28181-pro up to 2.7.4. This affects the function GenericFastJsonRedisSerializer of the file src/main/java/com/genersoft/iot/vmp/conf/redis/RedisTemplateConfig.java of the component API Endpoint. The manipulation results in deserialization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

A deserialization vulnerability exists in the wvp-GB28181-pro project (a video streaming platform using GB28181 protocol) through version 2.7.4, specifically in the GenericFastJsonRedisSerializer implementation within the Redis configuration. The flaw allows unauthenticated remote attackers to exploit insecure deserialization through the API endpoint, potentially achieving code execution or data manipulation with low complexity. A public proof-of-concept exploit has been released on GitHub, significantly increasing the risk of active exploitation, and the vendor has not responded to disclosure attempts.

Technical ContextAI

The vulnerability resides in the GenericFastJsonRedisSerializer class used in src/main/java/com/genersoft/iot/vmp/conf/redis/RedisTemplateConfig.java of wvp-GB28181-pro, a Java-based video surveillance platform implementing the GB28181 protocol standard. This component is responsible for serializing and deserializing objects stored in Redis cache. The root cause is CWE-502 (Deserialization of Untrusted Data), where the use of FastJson's generic serializer allows attackers to craft malicious serialized objects that, when deserialized by the application, can instantiate arbitrary classes and execute attacker-controlled code. The affected product is identified by CPE cpe:2.3:a:648540858:wvp-gb28181-pro:*:*:*:*:*:*:*:*, indicating all versions up to and including 2.7.4 contain this flaw. FastJson has a documented history of deserialization vulnerabilities, making its use in security-sensitive contexts particularly risky.

RemediationAI

As the vendor has not responded to the security disclosure and no official patch has been released, organizations should immediately implement compensating controls until a fix becomes available. Monitor the project's GitHub repository for updates beyond version 2.7.4 that may address this issue. In the interim, restrict network access to the wvp-GB28181-pro API endpoints using firewall rules or network segmentation to allow only trusted IP addresses. Deploy a web application firewall (WAF) with rules to detect and block malicious serialized payloads targeting Redis endpoints. Consider replacing GenericFastJsonRedisSerializer with a safer alternative such as Jackson-based serializers (GenericJackson2JsonRedisSerializer) or implementing allowlist-based deserialization filters. If possible, disable or remove the vulnerable Redis configuration component entirely if it is not critical to operations. Review application logs for suspicious API activity patterns that may indicate exploitation attempts, particularly unusual Redis operations or deserialization errors. Refer to the public exploit at https://github.com/wing3e/public_exp/issues/1 to understand attack signatures for detection engineering.