Artemis Deserialization Vulnerability Enables Arbitrary Code Execution

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.

Casky was already ahead

This CVE exploits attack patterns that Casky's 447matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-86404 is a critical deserialization vulnerability in EAP's Artemis messaging system where the ObjectMessage.getObject() method permits deserialization of arbitrary classes by default. The vulnerability stems from an empty allow-list in the ObjectInputStreamWithClassLoader filtering mechanism—when the allow-list size equals zero, isTrustedType() returns true for all classes, effectively disabling the security control entirely. This affects organizations running unpatched Artemis instances handling untrusted message content, as attackers can craft malicious serialized objects to achieve remote code execution. The high CVSS score of 8.8 reflects the severity of unrestricted deserialization, a well-known attack vector that can lead to complete system compromise.

Casky's 447 matched security skills leverage Claude's extended reasoning to correlate this vulnerability with MITRE ATT&CK techniques TA0001 (Reconnaissance), TA0043 (Reconnaissance via supply chain), and TA0002 (Execution). Practitioners using Casky will receive findings that trace how an attacker might probe Artemis endpoints for vulnerable deserialization behavior (Reconnaissance), exploit message queues to inject malicious serialized payloads (Execution via Deserialization of Untrusted Data), and escalate privileges post-exploitation. The platform's Claude-powered analysis connects observable indicators—such as ObjectInputStreamWithClassLoader instantiation without explicit allow-list configuration, unusual class instantiation patterns in message processing logs, and unexpected process spawning after message consumption—to the specific attack chains. Security teams gain actionable detection rules and behavioral signatures mapped directly to this CVE's exploitation patterns.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

447 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-86404.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-86404

Casky has 447 skills that investigate the attack patterns behind CVE-2026-86404. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn