Remote Code Execution in XStream
Priority CRITICAL 87CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 11 fixed, 6 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.
Summary
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.84968 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial xstream (x-stream): 1.4.14com.thoughtworks.xstream:xstream (Maven): 1.4.14-java7Red Hat: 8 advisoriesRed Hat: 11 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| XStream | xstream | before 1.4.14 | 1.4.14 | Patch available | CNA |
| — | com.thoughtworks.xstream:xstream (Maven) | before 1.4.14-java7 | 1.4.14-java7 | Patch available | GHSA-mw36-7c6c-q4q2 |
- xstream VendorXStream Affected before 1.4.14 Fixed in 1.4.14 Patch available CNA
- com.thoughtworks.xstream:xstream (Maven) Vendor— Affected before 1.4.14-java7 Fixed in 1.4.14-java7 Patch available GHSA-mw36-7c6c-q4q2
CPE configurations NVD · 37
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:* | before 1.4.14 | Vulnerable | XStream |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:sap:*:* | all versions | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* | before 5.15.14 | Vulnerable | Apache |
| cpe:2.3:a:apache:activemq:5.16.0:*:*:*:*:*:*:* | 5.16.0 | Vulnerable | Apache |
| cpe:2.3:a:oracle:banking_cash_management:14.2:*:*:*:*:*:*:* | 14.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_cash_management:14.3:*:*:*:*:*:*:* | 14.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_cash_management:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
- cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:* Versions before 1.4.14 Vulnerable ·XStream
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:sap:*:* Versions all versions Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* Versions before 5.15.14 Vulnerable ·Apache
- cpe:2.3:a:apache:activemq:5.16.0:*:*:*:*:*:*:* Versions 5.16.0 Vulnerable ·Apache
- cpe:2.3:a:oracle:banking_cash_management:14.2:*:*:*:*:*:*:* Versions 14.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_cash_management:14.3:*:*:*:*:*:*:* Versions 14.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_cash_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
Show 27 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2:*:*:*:*:*:*:* | 14.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3:*:*:*:*:*:*:* | 14.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2:*:*:*:*:*:*:* | 14.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3:*:*:*:*:*:*:* | 14.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:* | 2.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:* | 2.7.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:* | 2.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_supply_chain_finance:14.2:*:*:*:*:*:*:* | 14.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_supply_chain_finance:14.3:*:*:*:*:*:*:* | 14.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_supply_chain_finance:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2:*:*:*:*:*:*:* | 14.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3:*:*:*:*:*:*:* | 14.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5:*:*:*:*:*:*:* | 14.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:* | 11.1.1.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:* | 12.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0.0:*:*:*:*:*:*:* | 3.2.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:* | 16.0.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:* | 17.0.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:* | 18.0.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:* | 19.0.2 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2:*:*:*:*:*:*:* Versions 14.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3:*:*:*:*:*:*:* Versions 14.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2:*:*:*:*:*:*:* Versions 14.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3:*:*:*:*:*:*:* Versions 14.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:* Versions 2.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_supply_chain_finance:14.2:*:*:*:*:*:*:* Versions 14.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_supply_chain_finance:14.3:*:*:*:*:*:*:* Versions 14.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_supply_chain_finance:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2:*:*:*:*:*:*:* Versions 14.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3:*:*:*:*:*:*:* Versions 14.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5:*:*:*:*:*:*:* Versions 14.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:* Versions 12.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0.0:*:*:*:*:*:*:* Versions 3.2.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:* Versions 16.0.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:* Versions 17.0.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:* Versions 18.0.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:* Versions 19.0.2 Vulnerable ·Oracle
Remediation
- Fix · CNA xstream (x-stream) Fixed in 1.4.14
- Fix · GHSA-mw36-7c6c-q4q2 com.thoughtworks.xstream:xstream (Maven) Fixed in 1.4.14-java7 Advisory →
Red Hat 8 advisories
- RHSA-2021:5134 Released 2021-12-14 · Red Hat rating CriticalRed Hat Fuse 7.10.0 release and security update
- Red Hat Fuse 7.10
- RHSA-2021:4767 Released 2021-11-23 · Red Hat rating ModerateRed Hat Integration Camel Extensions for Quarkus GA security update
- Red Hat Integration Camel Quarkus 2
- RHSA-2021:3205 Released 2021-08-18 · Red Hat rating ModerateRed Hat Integration Camel-K 1.4 release and security update
- Red Hat Integration
Show 5 more Red Hat advisories
- RHSA-2021:0433 Released 2021-02-08 · Red Hat rating ModerateRed Hat Data Grid 8.1.1 security update
- Red Hat Data Grid 8.1.1
- RHSA-2021:0384 Released 2021-02-02 · Red Hat rating ImportantRed Hat JBoss Fuse/A-MQ 6.3 R18 security and bug fix update
- Red Hat Fuse/AMQ 6.3.18
- RHSA-2021:0162 Released 2021-01-18 · Red Hat rating Importantxstream security update
- Red Hat Enterprise Linux Client Optional (v. 7) xstream-1.3.1-12.el7_9, xstream-javadoc-1.3.1-12.el7_9
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) xstream-1.3.1-12.el7_9, xstream-javadoc-1.3.1-12.el7_9
- Red Hat Enterprise Linux Server Optional (v. 7) xstream-1.3.1-12.el7_9, xstream-javadoc-1.3.1-12.el7_9
- Red Hat Enterprise Linux Workstation Optional (v. 7) xstream-1.3.1-12.el7_9, xstream-javadoc-1.3.1-12.el7_9
- RHSA-2021:0105 Released 2021-01-13 · Red Hat rating ImportantRed Hat Process Automation Manager 7.9.1 security update
- RHPAM 7.9.1
- RHSA-2021:0106 Released 2021-01-13 · Red Hat rating ImportantRed Hat Decision Manager 7.9.1 security update
- RHDM 7.9.1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| RHDM 7.9.1 | Fixed | RHSA-2021:0106 |
| RHPAM 7.9.1 | Fixed | RHSA-2021:0105 |
| Red Hat Data Grid 8.1.1 | Fixed | RHSA-2021:0433 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2021:0162 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2021:0162 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2021:0162 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2021:0162 |
| Red Hat Fuse 7.10 | Fixed | RHSA-2021:5134 |
| Red Hat Fuse/AMQ 6.3.18 | Fixed | RHSA-2021:0384 |
| Red Hat Integration | Fixed | RHSA-2021:3205 |
| Red Hat Integration Camel Quarkus 2 | Fixed | RHSA-2021:4767 |
Not affected: 2 products
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2020-26217
- 2026-10-03 Alias added: GHSA-mw36-7c6c-q4q2
- 2026-10-07 CISA SSVC decision points changed
- 2026-10-07 Priority changed: HIGH → CRITICAL
References
Patch 4
Advisory 7
- https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2
- [debian-lts-announce] 20201201 [SECURITY] [DLA 2471-1] libxstream-java security update
- DSA-4811
- https://security.netapp.com/advisory/ntap-20210409-0004/
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-26217
Other 10
- [activemq-issues] 20201230 [jira] [Created] (AMQ-8107) Does ActiveMQ use the affected functionality within Xstream libraries for CVE-2020-26217
- [activemq-issues] 20201230 [jira] [Updated] (AMQ-8107) Does ActiveMQ use the affected functionality within Xstream libraries for CVE-2020-26217
- [activemq-issues] 20210104 [jira] [Resolved] (AMQ-8107) Does ActiveMQ use the affected functionality within Xstream libraries for CVE-2020-26217
- [camel-commits] 20211006 [camel] branch main updated: Camel-XStream: Added a test about CVE-2020-26217
- https://security.netapp.com/advisory/ntap-20210409-0004
- https://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9@%3Ccommits.camel.apache.org%3E
- https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e@%3Cissues.activemq.apache.org%3E
- https://github.com/x-stream/xstream
More Xstream vulnerabilities
- TI-2021-16530 XStream is vulnerable to a Remote Command Execution attack KEVCVSS 3.1HIGH 8.5
- TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
- TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
- TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
- TI-2021-04444 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
- TI-2019-07494 Code injection in xstream CVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-26217 · CVE Program
- CVE-2020-26217 · NVD
- FIRST EPSS
- GHSA-mw36-7c6c-q4q2 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-26217 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences