THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-40860 (CRITICAL 9.8) — JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or class denylist. Becaus

[NVD] CVE-2026-40860 (CRITICAL 9.8) — JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or class denylist. Becaus

lownvdPublished 2026-04-27

CVE-2026-40860 CVSS: 9.8 CRITICAL Published: 2026-04-27T09:16:01.770

JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is reached whenever the mapJmsMes

Indicators of compromise

CVE-2026-40860cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-40860