Camel deserialization RCE via JMS (CVE-2026-40860)

Patch now - CVE-2026-40860 is a critical deserialization flaw in Apache Camel 3.0.0 through 4.19.0 that grants unauthenticated remote code execution when Camel consumes JMS messages. Patched in 4.20.0, 4.14.7, and 4.18.2; update immediately to prevent exploitation.

Overview

CVE-2026-40860 involves a missing input filter in the JmsBinding.extractBodyFromJms() method in camel-jms and the equivalent class in camel-sjms. When the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer, the application deserializes the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist, or class denylist.

This vulnerability affects Apache Camel versions:

• 3.0.0 before 4.14.7
• 4.15.0 before 4.18.2
• 4.19.0 before 4.20.0

The flawed code path is also reached transitively through camel-sjms2 (whose Sjms2Endpoint extends SjmsEndpoint), camel-amqp (whose AMQPJmsBinding extends JmsBinding), camel-activemq, and camel-activemq6.

Impact

An attacker who can publish a crafted JMS ObjectMessage to a queue or topic consumed by a Camel application can achieve remote code execution if a deserialization gadget chain is present on the classpath. The CVSS 9.8 rating reflects the network-based attack vector, low complexity, and no required privileges or user interaction.

Remediation

Users should upgrade to version 4.20.0. For those on the 4.14.x LTS release stream, upgrade to 4.14.7. For users on the 4.18.x release stream, upgrade to 4.18.2.

If immediate patching is not possible, consider the following mitigations:

• Disable the mapJmsMessage option if JMS ObjectMessage handling is not required
• Apply network segmentation to restrict who can publish to JMS queues and topics
• Monitor for suspicious JMS messages containing unexpected ObjectMessage types

Security Insight

This vulnerability follows a pattern reminiscent of the Apache ActiveMQ CVE-2026-34197, which was also a deserialization RCE vector added to CISA KEV amid active exploitation. Both vulnerabilities underscore a recurring blind spot in Java middleware frameworks: default-on deserialization sinks that trust message payloads without validation. The fact that this flaw spans multiple Camel components - including AMQP, SJMS, and ActiveMQ integrations - suggests the architecture lacks a centralized deserialization security boundary, which affected components should adopt to prevent recurrence.

Further Reading

• Apache ActiveMQ CVE-2026-34197 added to CISA KEV catalo
• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs