The vulnerability lies in Red Hat Enterprise Application Platform’s usage of Artemis as the JMS provider. Artemis’s deserialization configuration defaults to allow‑the‑everything behavior: the ObjectInputStreamWithClassLoader accepts any class type when the allow‑list is empty. An attacker that can supply a malicious ObjectMessage can cause the server to deserialize the payload, leading to arbitrary code execution or other compromise of confidentiality, integrity, or availability. The weakness is identified as CWE‑502, insecure deserialization.

Affected are Red Hat AMQ Broker 7, Red Hat JBoss Enterprise Application Platform 7 and 8, and Red Hat builds of Apache Camel 4 for Quarkus 3 and Spring Boot 4. The vulnerability impacts any deployment that uses Artemis messaging handlers with the default deserialization configuration – that includes typical EAP/JBoss messaging setups and any application that relies on pooled‑connection‑factory resources. Version details are not explicitly listed in the CNA affected‑version table, but all supported releases of the mentioned products are vulnerable until a fix is applied.

The CVSS score of 8.8 classifies the flaw as high severity. The EPSS score is not available, yet the absence of a blocking allow‑list indicates that exploitation is straightforward for anyone who can send a crafted JMS message. Although the flaw is not currently in the CISA KEV catalog, its impact and lack of countermeasures make it a high‑risk vulnerability. The likely attack vector is the delivery of a malicious ObjectMessage over JMS from an external source; the vulnerability can be exploited without authentication if the message is accepted by a pooled‑connection‑factory resource.