dd-trace-java, a Datadog APM client for Java contains an RMI endpoint that deserializes incoming data without applying serialization filters. The flaw, classified as CWE‑502, allows an attacker who can reach the JMX or RMI port of a JVM instrumented with dd‑trace‑java (versions 00 through 1.60.2) to exploit an unsafe deserialization path and potentially execute arbitrary code on the guest operating system. the vulnerability requires three conditions: the Java agent must be attached, a JMX/RMI port must be configured and network‑reachable, and a gadget‑chain compatible library must exist on the classpath. When all three conditions are satisfied, the attacker can gain full control of the JVM process, yielding confidentiality, integrity, and availability compromise.

The affected vendor is DataDog, with the product dd‑trace‑java. Versions from 0.40.0 through 1.60.2 are vulnerable. The issue applies only to Java 8u121 up to, but not including, JDK 17. Java 17 and later provide serialization filters that mitigate the flaw. For JDK versions older than 8u121, serialization filters are not available, making the vulnerability more severe. Users running dd‑trace‑java before 1.60.3 on Java 8u121 or higher, or on older JDKs with the agent attached, are at risk.

The flaw carries a CVSS score of 9.3, indicating a critical risk level. The EPSS score is not available, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Attackers would need network access to a reachable JMX or RMI port, which is typically limited to internal networks. The vulnerability is remotely exploitable through the RMI interface, and requires the presence of gadget‑chain libraries in the JVM classpath. The realistic likelihood of exploitation depends on whether the environment exposes the JMX/RMI port externally and whether vulnerable libraries are present. Such conditions are common in production deployments of dd‑trace‑java without proper network hardening, making the overall risk high for impacted configurations.