EUVD-2026-46173
GHSA-qwm7-r3rv-3hw8
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 21, 2026
Remote code execution risk in Apache Fory (the Java serialization framework formerly known as Fury) before 1.4.0 arises because attacker-supplied data can bypass the class-registration allowlist during Java lambda deserialization, with the gap confined to the lambda capture class. Registration checks are Fory's core defense against untrusted-deserialization gadget attacks, so bypassing them for lambda payloads can let an attacker instantiate otherwise-disallowed classes and reach code execution or memory corruption. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV; the vendor (Apache) rates it CVSS 9.8 and a fixed release (1.4.0) is available.
Earlier versions of this analysis (1)
Class-registration filter bypass in Apache Fory before 1.4.0 lets attacker-supplied serialized data evade the framework's allow-list checks during Java lambda deserialization, undermining a core anti-gadget defense (CWE-502). The weakness is scoped narrowly to the lambda capture class, but a bypassed registration check can permit deserialization of otherwise-blocked types and enable downstream gadget-chain abuse. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Java gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attacker-supplied data is typically network-delivered (AV:N, PR:N); AC:H because a usable gadget and untrusted-deserialization sink must exist and only the lambda capture class is affected; high C/I/A reflects potential gadget-chain code execution.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected
This issue affects Apache Fory: from before 1.4.0.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Articles & Coverage 2
Executive ViewAI
Any organization using Apache Fory (Java serialization framework) in versions before 1.4.0 faces a critical vulnerability (CVSS 9.8) that enables attackers to remotely execute arbitrary code through Java lambda deserialization, bypassing built-in security controls. This vulnerability threatens the confidentiality, integrity, and availability of affected Java systems and the data they handle. Immediate patching to version 1.4.0 is required to eliminate this risk.
Within 24 hours, identify all Java applications and services using Apache Fory and document their current versions to determine exposure scope. Within 7 days, upgrade all instances of Apache Fory to version 1.4.0 or later, prioritizing production environments and customer-facing systems; coordinate with development teams to validate deployments through testing before moving to production. Within 30 days, complete a comprehensive audit of all remaining systems to confirm successful upgrades and implement automated dependency scanning to detect future Fory vulnerabilities.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Exploit-DB