EUVD-2026-72352

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...

CVE-2026-86404

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...

PT-2026-86687

🚨HIGH - Red Hat EAP Artemis ObjectMessage Unsafe Deserialization Default CVE-2026-86404 In Red Hat EAP’s Artemis messaging, the deserialization trust check allows any class when both allow-list and block-list are empty, so untrusted ObjectMessage payloads deserialize by default. Remote attackers...