What is the CVSS score of EUVD-2026-46173?

EUVD-2026-46173 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Java are affected by EUVD-2026-46173?

Any organization using Apache Fory (Java serialization framework) in versions before 1.4.0 faces a critical vulnerability (CVSS 9.8) that enables attackers to remotely execute arbitrary code through…. A patch is available.

How to fix or mitigate EUVD-2026-46173?

Within 24 hours, identify all Java applications and services using Apache Fory and document their current versions to determine exposure scope. Within 7 days, upgrade all instances of Apache Fory to version 1.4.0 or later, prioritizing production environments and customer-facing systems; coordinate with development teams to validate deployments through testing before moving to production. Within 30 days, complete a comprehensive audit of all remaining systems to confirm successful upgrades and implement automated dependency scanning to detect future Fory vulnerabilities.

Java EUVD-2026-46173

| CVE-2026-64606 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-07-21 apache

GHSA-qwm7-r3rv-3hw8

Java Apache Deserialization Apache Fory

9.8

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

9.8 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Attacker-supplied data is typically network-delivered (AV:N, PR:N); AC:H because a usable gadget and untrusted-deserialization sink must exist and only the lambda capture class is affected; high C/I/A reflects potential gadget-chain code execution.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 21, 2026 - 14:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 21, 2026 - 14:22 vuln.today

cvss_changed

CVSS changed

Jul 21, 2026 - 14:22 NVD

9.8 (CRITICAL)

Patch available

Jul 21, 2026 - 12:32 EUVD

Analysis Generated

Jul 21, 2026 - 11:20 vuln.today

CVE Published

Jul 21, 2026 - 10:43 cve.org

HIGH

DescriptionCVE.org

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected

This issue affects Apache Fory: from before 1.4.0.

Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Articles & Coverage 2

News 6 New Java Vulnerabilities - 1 Critical, 5 High Severity Jul 22, 2026 News Critical RCE in Apache Fury Java Serialization Framework - CVE-2026-64606 Jul 21, 2026

AnalysisAI

Remote code execution risk in Apache Fory (the Java serialization framework formerly known as Fury) before 1.4.0 arises because attacker-supplied data can bypass the class-registration allowlist during Java lambda deserialization, with the gap confined to the lambda capture class. Registration checks are Fory's core defense against untrusted-deserialization gadget attacks, so bypassing them for lambda payloads can let an attacker instantiate otherwise-disallowed classes and reach code execution or memory corruption. …