CVE-2026-86404 in AMQ Broker
Resumen
por MITRE • 2026-09-07
EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.