CVE-2026-107726: 
Java vulnerability analysis and mitigation

CVE-2026-107726 is a critical improper input validation vulnerability in Hazelcast (Community and Enterprise Editions) that allows a low-privileged malicious client connected to a cluster to read arbitrary data from cluster member memory, including Java heap memory, off-heap data, and JVM process address space. In some Hazelcast Enterprise Edition configurations, the flaw can also corrupt memory and potentially enable remote code execution. Affected versions include all releases prior to 5.4.5, versions 5.5.0–5.5.9, and version 5.6.0; both slim and full distributions are impacted. The vulnerability was published to the GitHub Advisory Database on October 8, 2026, and carries a CVSS v4.0 base score of 9.3 (Critical) (Github Advisory, Hazelcast Advisory).

The root cause is improper input validation (CWE-20) in Hazelcast's Zero Config Compact Serialization (ZCCS) subsystem, which failed to restrict which classes could be used during reflective deserialization. A malicious client that can connect to the cluster — even with low privileges — can supply crafted serialized data that bypasses validation, triggering arbitrary memory reads across the JVM heap, off-heap regions, and the full process address space. The fix, introduced in commit 361979d, adds a configurable ReflectiveClassFilter centralized within CompactStreamSerializer that enforces allowlist/blocklist restrictions on classes eligible for ZCCS before deserialization begins (Hazelcast Commit, Github Advisory). No public proof-of-concept exploit code has been identified at this time.

Successful exploitation allows a low-privileged attacker to read arbitrary contents of a cluster member's Java heap, off-heap memory, and JVM process address space, exposing sensitive data such as credentials, encryption keys, and application data stored in the cluster. In some Hazelcast Enterprise Edition configurations, the attacker can additionally corrupt memory, potentially achieving remote code execution on cluster members. Availability is also at risk, as the flaw can be used to crash one or more cluster members, disrupting real-time data processing workloads (Github Advisory, Hazelcast Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no privileges and no user interaction, and is exploitable over the network with low complexity, making it highly attractive to threat actors if exploit code becomes available (Github Advisory). The vulnerability was credited to researcher k-jamroz (Hazelcast Advisory).

Hazelcast has released fixed versions for both Community and Enterprise Editions: 5.4.5, 5.5.10, 5.6.1, and 5.7.0. Enterprise customers with extended support contracts should contact Hazelcast Support for patches covering older versions. If immediate upgrade is not possible, Hazelcast recommends restricting cluster access to trusted clients only, enabling Hazelcast Security with client authorization enforcement, defining an explicit allowlist for Zero Config Compact Serialization, protecting the cluster with firewall rules, and avoiding exposure of cluster ports to internet-facing or non-secure networks (Github Advisory, Hazelcast Advisory).