Which versions of H2O-3 are affected by CVE-2026-8751?

CVE-2026-8751 is a critical remote code execution vulnerability in H2O-3 (versions ≤7402) that allows unauthenticated attackers to execute arbitrary code by submitting malicious files to the…

Is there a public PoC exploit available for CVE-2026-8751?

Yes, a public proof-of-concept exploit is available for CVE-2026-8751. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-8751?

Within 24 hours: Identify all systems running H2O-3 versions 7402 and earlier; disable or restrict network access to the importBinaryModel API endpoint immediately. Within 7 days: Evaluate migration to alternative ML platforms or isolated H2O-3 instances in air-gapped environments; contact H2O vendor directly to escalate patch development. Within 30 days: Complete migration to patched version (once released) or implement compensating controls listed below; conduct code review of any models imported via this function in the past 12 months.

H2O-3 CVE-2026-8751

Q: What is the CVSS score of CVE-2026-8751?

CVE-2026-8751 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30697 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-05-17 VulDB

GHSA-gvx7-3472-56wj

Java Deserialization

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 17, 2026 - 12:22 NVD

HIGH MEDIUM

CVSS changed

May 17, 2026 - 12:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

May 17, 2026 - 12:01 vuln.today

DescriptionCVE.org

A security flaw has been discovered in h2oai h2o-3 up to 7402. This affects the function importBinaryModel of the file h2o-core/src/main/java/hex/Model.java of the component JAR Handler. Performing a manipulation results in deserialization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Deserialization vulnerability in H2O-3 machine learning platform versions up to 7402 enables remote code execution through the importBinaryModel function when processing malicious JAR files. The vulnerability allows unauthenticated remote attackers to execute arbitrary code with publicly available exploit code (CVSS 7.3, EPSS not provided). The vendor failed to respond to disclosure attempts, leaving users without an official patch.

Technical ContextAI

H2O-3 is an open-source machine learning platform written in Java. The vulnerability exists in the importBinaryModel function within h2o-core/src/main/java/hex/Model.java, which handles JAR file imports. The root cause is unsafe deserialization (CWE-502), where untrusted data is deserialized without proper validation, allowing attackers to instantiate arbitrary Java objects and execute code. The CPE identifier cpe:2.3:a:h2oai:h2o-3:*:*:*:*:*:*:*:* confirms all versions up to 7402 are affected.

RemediationAI

No vendor-released patch identified at time of analysis due to vendor non-response. Organizations should immediately disable or restrict access to the importBinaryModel functionality if not required for operations. Block external access to H2O-3 instances at the network perimeter and implement strict input validation for any JAR files processed by the system. Consider downgrading critical deployments to versions prior to the affected range if available, though specific safe versions are not confirmed. Monitor H2O.ai's GitHub repository for potential community patches. As a last resort, consider migrating to alternative ML platforms until vendor addresses the vulnerability.