EUVD-2026-24738
GHSA-xfxp-ppx7-cqrp
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Blast Radius
ecosystem impact- 10 maven packages depend on org.apache.camel:camel-infinispan (2 direct, 8 indirect)
Ecosystem-wide dependent count for version 4.20.0.
DescriptionCVE.org
A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.
AnalysisAI
Remote code execution in Red Hat Apache Camel Infinispan component allows low-privileged attackers to execute arbitrary code via unsafe deserialization in ProtoStream remote aggregation repository. Exploiting this vulnerability requires network access and low-privilege credentials but grants full system compromise affecting confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Remote attackers must possess low-privilege authenticated access to Camel endpoints or Infinispan remote cache services that utilize the ProtoStream remote aggregation repository feature. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 7.5 (High) reflects severe impact (C:H/I:H/A:H) but includes two important mitigating factors: high attack complexity (AC:H) and low-privilege requirement (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with valid low-privilege credentials to a Red Hat Fuse or JBoss EAP application authenticates to an exposed Camel endpoint configured with Infinispan remote caching. The attacker crafts a malicious serialized Java object containing exploit gadgets from the application's classpath and sends it as part of a remote aggregation request to the ProtoStream repository. … |
| Remediation | Vendor-released patch status cannot be confirmed from available data; consult Red Hat Product Security advisory at https://access.redhat.com/security/cve/CVE-2026-6857 for update availability and exact fixed versions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running Red Hat Apache Camel with Infinispan component enabled and document current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today