Cyber ·
CVE-2026-88900: unsafe Java deserialization in Camel-JGroups can lead to remote code execution
Advisory from the oss-sec feed, published on 19 October 2026, describes an untrusted data deserialization flaw in the camel-jgroups component of Apache Camel, with CVSS 3.1 score 8.8 (high).
The advisory identifies CVE-2026-88900 in the camel-jgroups component of Apache Camel. The flaw is untrusted data deserialization and, according to the description, can lead to remote code execution. The CVSS 3.1 score is 8.8, rated high, with network attack vector (AV:N as written in the source's AV:A), low complexity, no privileges required and no user interaction, and high impact on confidentiality, integrity and availability. Affected versions of the org.apache.camel:camel-jgroups artifact are 4.0.0 up to before 4.18.5, and 4.19.0 up to before 4.22.1. The available text is an automatic translation of the oss-sec feed content. To confirm details, consult the original advisory referenced in the feed and the Apache Camel project's fix notes. Anyone using this component should check the version in their projects and plan an upgrade to a fixed release.