Is CVE-2026-85257 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85257 being exploited in the wild.

How severe is CVE-2026-85257?

Medium severity, with a CVSS score of 5.3, published 19 October 2026.

Which products and versions are affected?

Apache Camel 4.0.0 to 4.18.4, 4.19.0 to 4.22.0.

How is CVE-2026-85257 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-85257?

Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85257: Apache Camel CXF error message information disclosure

CVE-2026-85257 · Severity: medium · CVSS 5.3 · Published 2026-10-19

Apache Camel's CXF component, which handles SOAP web services, leaks sensitive internal information through error messages returned to clients. When an undeclared exception occurs, the service exposes class names, package names, and stack traces in fault responses, allowing attackers who can trigger errors to learn about the system's internal structure and deployment details.

Technologies: Apache Camel. Vendors: Apache.

Quick answers

Is CVE-2026-85257 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85257 being exploited in the wild.
How severe is CVE-2026-85257?: Medium severity, with a CVSS score of 5.3, published 19 October 2026.
Which products and versions are affected?: Apache Camel 4.0.0 to 4.18.4, 4.19.0 to 4.22.0.
Is there a fix for CVE-2026-85257?: Yes: fixed in Apache Camel 4.23.0, 4.18.5, 4.22.1. Until then: Set the muteException consumer option to true (the default in fixed versions) to suppress undeclared exception details in SOAP faults. For systems unable to upgrade immediately, declare all exceptions the service may report and use onException handlers to map any unexpected failures onto declared faults. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85257 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-85257?: Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Apache Camel 4.23.0, 4.18.5, 4.22.1

Set the muteException consumer option to true (the default in fixed versions) to suppress undeclared exception details in SOAP faults. For systems unable to upgrade immediately, declare all exceptions the service may report and use onException handlers to map any unexpected failures onto declared faults.

Technical details

The vulnerability occurs in Apache Camel's CXF SOAP consumer when an exception is raised that is not declared in the service contract. CXF copies the exception message and optionally stack trace into SOAP fault strings/details, exposing internal class names, package names, and exception details. An external attacker with network access to the SOAP service can trigger undeclared exceptions through malformed requests to read sensitive deployment information; declared @WebFault exceptions are unaffected and continue to function as designed.

Affected products

Apache Camel 4.0.0 to 4.18.4, 4.19.0 to 4.22.0

Timeline

2026-10-19: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.