Vulnerability details
CVE-2026-6857
Red Hat Fuse 7Red Hat build of Apache Camel 4 for Quarkus 3
Camel-infinispan: camel-infinispan: remote code execution via unsafe deserialization
CVSS 3.1
7.5High
Official description
A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (redhat) | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Red Hat | Red Hat Fuse 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Fuse 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | All | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://access.redhat.com/security/cve/CVE-2026-6857 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2460003 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6857.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:22453 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17668 vendor-advisoryx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-04-22
- Last updated
- 2026-10-09
- State
- Published
- Assigner (CNA)
- redhat
Exploit prediction (EPSS)
0.66%
Probability of exploitation in 30 days
52%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-502Deserialization of Untrusted Data