Critical 2 vendors · 3 advisories

CVE-2026-40860

Unified cross-vendor view: this CVE is referenced by 2 tracked vendors. Each vendor rates and fixes it independently — confirm the impact for your specific products below.

NVD detail CVE.org

Apache2 advisories

Critical9.8Apache Camel: JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the pay…Apr 27, 2026
High7.3Apache Camel: Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component.Jul 6, 2026

Linux1 advisory

High7.5Remote Code Execution via deserialization of JMS ObjectMessageApr 27, 2026