Is CVE-2026-88900 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88900 being exploited in the wild.

How severe is CVE-2026-88900?

High severity, with a CVSS score of 8.8, published 19 October 2026.

Which products and versions are affected?

Apache Camel 4.0.0 before 4.18.5, 4.19.0 before 4.22.1.

How is CVE-2026-88900 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Am I affected by CVE-2026-88900?

Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88900: Apache Camel deserialization of untrusted data in JGroups component

CVE-2026-88900 · Severity: high · CVSS 8.8 · Published 2026-10-19

Apache Camel's JGroups integration component fails to validate serialized objects before instantiating them, allowing an attacker on the network to send malicious messages that execute arbitrary code. The JGroups protocol stack uses unencrypted UDP multicast by default, enabling any host on an adjacent network to join the cluster and trigger code execution through gadget chain exploitation during object deserialization.

Technologies: Apache Camel. Vendors: Apache.

Quick answers

Is CVE-2026-88900 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88900 being exploited in the wild.
How severe is CVE-2026-88900?: High severity, with a CVSS score of 8.8, published 19 October 2026.
Which products and versions are affected?: Apache Camel 4.0.0 before 4.18.5, 4.19.0 before 4.22.1.
Is there a fix for CVE-2026-88900?: Yes: fixed in Apache Camel 4.23.0, 4.22.1, 4.18.5. Until then: Configure JGroups channel properties to enable authentication (AUTH protocol) and encryption on the multicast protocol stack, or restrict network access to the multicast group and bind port to only trusted hosts. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88900 attacked?: It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-88900?: Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Apache Camel 4.23.0, 4.22.1, 4.18.5

Configure JGroups channel properties to enable authentication (AUTH protocol) and encryption on the multicast protocol stack, or restrict network access to the multicast group and bind port to only trusted hosts.

Technical details

The Camel-JGroups consumer deserializes ObjectMessage payloads via JGroups' ObjectInputStream without applying a Java ObjectInputFilter, allowing instantiation of arbitrary serializable classes on the classpath. The JGroups channel uses an unauthenticated multicast protocol stack (UDP without AUTH) by default, permitting adjacent-network attackers to join and send crafted serialized objects. A usable gadget chain on the classpath enables remote code execution during deserialization.

Affected products

Apache Camel 4.0.0 before 4.18.5, 4.19.0 before 4.22.1

Timeline

2026-10-19: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.