CVE-2026-33728: Datadog dd-trace-java unsafe deserialization in RMI instrumentation

CVE-2026-33728 · Severity: critical · CVSS 9.8 · Published 2026-03-27

Datadog's Java tracing library, used for monitoring application performance, contains a security flaw that could allow an attacker to take control of a server. If the library is used on older versions of Java (version 16 or earlier) and has certain management ports open to the network, an attacker could remotely execute malicious code. This could lead to a full system compromise, data theft, or service disruption.

Vendors: Datadog, Maven.

Quick answers

Is CVE-2026-33728 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33728 being exploited in the wild.
How severe is CVE-2026-33728?
Critical severity, with a CVSS score of 9.8, published 27 March 2026.
Which products and versions are affected?
Datadog Dd-Trace-Java >= 0.40.0, < 1.60.3, 0.40.0 to 1.60.2; com.datadoghq:dd-java-agent (Maven) >= 0.40.0, < 1.60.3, ECOSYSTEM:introduced=0.40.0,fixed=1.60.3.
Is there a fix for CVE-2026-33728?
Yes. com.datadoghq:dd-java-agent (Maven): upgrade to 1.60.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33728 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33728?
Check whether you run Datadog Dd-Trace-Java or com.datadoghq:dd-java-agent (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.datadoghq:dd-java-agent (Maven): upgrade to 1.60.3 or later
    # set com.datadoghq:dd-java-agent to 1.60.3 in your pom.xml or build.gradle

Technical details

A deserialization of untrusted data vulnerability (CWE-502) exists in the RMI instrumentation of dd-trace-java. The library registers a custom endpoint that fails to apply serialization filters to incoming data. An attacker with network access to an explicitly configured JMX or RMI port can exploit this on JDK 16 and earlier to achieve remote code execution with the privileges of the JVM user. Exploitation requires the presence of a gadget-chain-compatible library on the classpath. The issue is fixed in version 1.60.3; users on older JDKs can also disable the RMI integration via environment variable.

Affected products

  • Datadog dd-trace-java >= 0.40.0, < 1.60.3

Identifiers

  • CVE-2026-33728
  • GHSA-579q-h82j-r5v2

Timeline

  • 2026-03-23: patched: Version 1.60.3 released
  • 2026-03-26: advisory: GitHub Advisory published
  • 2026-03-27: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.