EUVD-2026-72352

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...

CVE-2026-86404

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...

PT-2026-86687

Name of the Vulnerable Software and Affected Versions Red Hat EAP Artemis affected versions not specified Description Red Hat EAP Artemis contains a flaw where the deserialization configuration permits the deserialization of all classes by default. The ObjectMessage.getObject function utilizes...