Vulnerabilities / CVE-2026-78162
Critical · not yet confirmed exploited · Apache CamelCVE-2026-78162
Apache Camel critical remote code execution, CVSS 9.8.
Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a protection introduced by CVE-2026-43865. That change did not reach two of the configuration paths Camel builds itself, so those paths continued to create Hazelcast instances whose Java deserialization is unrestricted. ReplicatedHazelcastAggregationRepository extends HazelcastAggregationRepository but overrides doStart() without calling super.doStart(), keeping its own copy of the bootstrap block, and therefore never received the filter: a route using it without supplying a hazelcastInstance starts a Hazelcast member that deserializes values read from the backing ReplicatedMap with no class
| Vendor and product | Apache Software Foundation · Apache Camel |
|---|---|
| Type | remote code execution |
| Severity | Critical 9.8 CVSS base score |
| Affected versions | Apache Camel: 4.0.0 to before 4.18.5, 4.19.0 to before 4.22.1 |
| First published | 19 October 2026 |
| Weakness | CWE-502 Deserialization of Untrusted Data |
| Exploited | Not confirmed. Critical flaws in Apache Software Foundation products have been exploited before: Apache Software Foundation appears on CISA's exploited list. |
| Advisories | camel.apache.org ↗ · github.com ↗ · github.com ↗ |
Patch before it is exploited
Patch to the fixed version the vendor names, today if the product faces the internet.
Until it is patched, take the affected service off the internet or put it behind a VPN or allow-list.
Look for signs it was already used: new accounts, web shells, unexpected processes and outbound connections since the date it was listed.
Know the day it starts being used
Threat Landscape Monitoring fingerprints the software your internet-facing hosts disclose and tells you the day a vulnerability on them is confirmed exploited, with the host and the fix. The free plan covers one domain.
CVE-2026-78162 in short
Is CVE-2026-78162 being exploited?
Not confirmed as of 14 November 2026: CISA has not added it to its Known Exploited Vulnerabilities catalogue. Critical flaws in Apache Software Foundation products are a frequent target, so patch before that changes; this page is updated daily.
How severe is CVE-2026-78162?
NVD rates it critical, with a CVSS base score of 9.8.
Which versions of Apache Camel are affected by CVE-2026-78162?
According to the CVE record: Apache Camel: 4.0.0 to before 4.18.5, 4.19.0 to before 4.22.1. Check the vendor's advisory for the fixed version.
How do I fix CVE-2026-78162?
Patch to the fixed version the vendor names, today if the product faces the internet. Until it is patched, take the affected service off the internet or put it behind a VPN or allow-list. Look for signs it was already used: new accounts, web shells, unexpected processes and outbound connections since the date it was listed.
Sources: NVD, the CVE record, FIRST EPSS and the CISA Known Exploited Vulnerabilities catalogue. Page compiled automatically by SAK T.L.M, the threat-intelligence tool of SAK T.E.C, on 14 November 2026.