CVE-2026-40858

highpriority · track · 10EPSS 0.012 · 69 %ileexploit · PoCDEEUNLRUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

1.22% (69th) EPSS

CVSS 8.8 · high

Is it mine?

32 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-21

The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinispan cache used by a Camel application can inject a crafted serialized Java object that, when read during normal aggregation repository operations such as get or recover, results in arbitrary code execution in the context of the application. This issue affects Apache Camel: from 4.0.0 before 4.14.7, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.7. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2. The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23322 refers to the various commits that resolved the issue, and have more details. This issue follows the same class of vulnerability previously addressed in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.8highAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 2.8 · impact 5.9

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-502USCWE-502USCWE-502USCWE-502US

exploits (1)

Public proof-of-concept and weaponised exploit code.

oscerd/CVE-2026-40858Reproducer for CVE-2026-40858 — Apache Camel camel-infinispan remote aggregation repository unsafe deserialization (RCE)PoC · poc_in_github

affected products (32)

Products and version ranges known to be affected.

Apache Camel <4.14.6all versionscert_bundDE
Apache Camel <4.14.7all versionscert_bundDE
Apache Camel <4.18.1all versionscert_bundDE
Apache Camel <4.18.2all versionscert_bundDE
Apache Camel <4.20.0all versionscert_bundDE
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat Enterprise Linux Apache Camel for Spring Bootall versionscert_bundDEcpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot
Apache Camel< 4.14.6cert_bundDE
Apache Camel< 4.14.7cert_bundDE
Apache Camel< 4.18.1cert_bundDE
Apache Camel< 4.18.2cert_bundDE
Apache Camel< 4.20.0cert_bundDE
Apache Software Foundation Apache Camel4.0.0 → 4.14.7enisa_euvdEU
Apache Software Foundation Apache Camel4.15.0 → 4.18.2enisa_euvdEU
Apache Software Foundation Apache Camel4.19.0 → 4.20.0enisa_euvdEU
Apache Software Foundation Camel4.0.0 → 4.14.7fstec_bduRU
Apache Software Foundation Camel4.15.0 → 4.18.2fstec_bduRU
Apache Software Foundation Camel4.19.0 → 4.20.0fstec_bduRU
Apache Camel≤ vers:unknown/*ncsc_nlNL
Apache Software Foundation Apache Camel≤ vers:unknown/*ncsc_nlNL

showing 20 of 32

advisories (3)

Vendor and ecosystem advisories describing this.

NCSC-2026-0129Kwetsbaarheden verholpen in Apache CamelNL2026-04-29csaf · ncsc_nlNL
Apache Software Foundation heeft kwetsbaarheden verholpen in Apache Camel.
WID-SEC-W-2026-1271Apache Camel: Mehrere SchwachstellenDeutsch2026-04-26csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Apache Camel ausnutzen, um beliebigen Programmcode auszuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.
GHSA-4xwx-hvv7-7prjApache Camel-Infinispan Component Vulnerable to Deserialization of Untrusted Data2026-04-27ghsa · osvUS
The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinispan cache used by a Camel application can inject a crafted serialized Java object that, when read during normal aggregation repository operations such as get or recover, results in arbitrary code execution in the context of the application. This issue affects Apache Camel: from 4.0.0 before 4.14.7, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.7. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2. The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-23322 refers to the various commits that resolved the issue, and have more details. This issue follows the same class of vulnerability previously addressed in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund ncsc_nl osv NVD CVE.org MITRE

published 2026-04-27modified 2026-09-09

references (9)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan