High severity · published Apr 22, 2026
CVE-2026-6857
Camel-infinispan: camel-infinispan: remote code execution via unsafe deserialization
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Fuse 7 · Red Hat
All versions, or not specified · source: vendor, CISA
RH
Red Hat build of Apache Camel 4 for Quarkus 3 · Red Hat
All versions, or not specified · source: vendor, CISA
Affected product
RH
Red Hat build of Apache Camel 4 for Quarkus 3
Red Hat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6857
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6857
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:17668
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:22453
vdb-entry
https://access.redhat.com/security/cve/CVE-2026-6857
issue-tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2460003
More from Red Hat build of Apache Camel 4 for Quarkus 3
10.0
CVE-2026-47691
Netty has Insufficient Bailiwick Validation for NS Records
10.0
CVE-2026-45674
Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
9.9
CVE-2026-40453
Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection
9.8
CVE-2026-49875
Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
9.8
CVE-2026-40860
Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp