CVE-2026-33728: 
Java vulnerability analysis and mitigation

CVE-2026-33728 is a critical unsafe deserialization vulnerability in Datadog's dd-trace-java APM client (Maven package com.datadoghq:dd-java-agent), affecting versions 0.40.0 through 1.60.2. The RMI instrumentation component registered a custom endpoint that deserialized incoming data without applying serialization filters, enabling unauthenticated remote code execution on JDK 16 and earlier. The vulnerability was responsibly disclosed by Mohamed Amine ait Ouchebou (mrecho) of Indiesecurity via Datadog's bug bounty program and published on March 23, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, Datadog Advisory).

The root cause is classified as CWE-502 (Deserialization of Untrusted Data). The dd-trace-java RMI instrumentation registered a custom RMI endpoint that accepted and deserialized arbitrary Java objects from the network without applying Java serialization filters (introduced in JDK 8u121 and enforced more strictly in JDK 17+). An attacker with network access to an exposed JMX/RMI port can send a crafted serialized payload exploiting a gadget chain present on the target's classpath to achieve arbitrary code execution. Three conditions must all be true for exploitation: (1) dd-trace-java is attached as a -javaagent on JDK 16 or earlier; (2) a JMX/RMI port is explicitly configured via -Dcom.sun.management.jmxremote.port and is network-reachable; and (3) a gadget-chain-compatible library (e.g., commons-collections, Spring, etc.) is present on the classpath. The fix in v1.60.3 switches the RMI context payload to use primitive types, eliminating the unsafe deserialization path (GitHub Advisory, Release v1.60.3).

Successful exploitation grants an unauthenticated remote attacker arbitrary code execution with the full privileges of the JVM process running the instrumented application. This results in complete compromise of confidentiality, integrity, and availability of the affected system — including access to sensitive application data, modification or destruction of data, and potential service disruption. Depending on the JVM's privilege level and network position, an attacker could use the foothold for lateral movement within the environment (GitHub Advisory, Datadog Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been observed as of the time of this report (GitHub Advisory). The EPSS score is approximately 0.75% (0.00754), indicating a relatively low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation requires a specific combination of conditions (legacy JDK, exposed RMI port, gadget chain on classpath), which limits the attack surface compared to fully unconditional vulnerabilities.

1. Reconnaissance: Scan for internet- or network-exposed JMX/RMI ports (default range 1099, or custom ports configured via -Dcom.sun.management.jmxremote.port) using tools like Shodan, Censys, or Nmap. Identify JVMs running with dd-trace-java as a Java agent on JDK 16 or earlier.
2. Classpath enumeration: If possible, enumerate the target application's classpath to identify gadget-chain-compatible libraries (e.g., Apache Commons Collections, Spring Framework, Groovy) that can be leveraged for deserialization exploitation.
3. Craft malicious payload: Use a tool such as ysoserial to generate a serialized Java object payload targeting a known gadget chain present on the classpath (e.g., java -jar ysoserial.jar CommonsCollections6 'cmd /c calc').
4. Deliver payload: Send the crafted serialized payload to the exposed RMI endpoint registered by dd-trace-java's RMI instrumentation, using a custom RMI client or a tool like rmg (Remote Method Guesser) that can invoke remote methods with arbitrary serialized arguments.
5. Achieve code execution: The JVM deserializes the payload without applying serialization filters, triggering the gadget chain and executing the attacker's command with the privileges of the JVM process (GitHub Advisory, Datadog Advisory).

• Network: Unexpected inbound connections to JMX/RMI ports (e.g., TCP 1099 or custom configured ports) from untrusted or external IP addresses; outbound connections from the JVM process to unknown external hosts following RMI activity.
• Process: Unusual child processes spawned by the Java process (e.g., cmd.exe, /bin/bash, curl, wget, powershell) that are not part of normal application behavior; unexpected process execution chains originating from the JVM.
• Logs: JVM or application logs showing RMI deserialization errors, ClassNotFoundException, or unexpected ObjectInputStream activity; JMX access logs recording connections from unexpected source IPs.
• File System: New or modified files in the application working directory or temp directories created by the JVM process; unexpected scripts, binaries, or web shells dropped by the Java process user account.
• Registry/Scheduled Tasks (Windows): New scheduled tasks or registry run keys created under the account running the JVM process.

The primary remediation is to upgrade dd-trace-java (Maven: com.datadoghq:dd-java-agent) to version 1.60.3 or later, which fixes the vulnerability by using primitive types for RMI context payload serialization, eliminating unsafe deserialization (Release v1.60.3). For environments running JDK >= 17, no immediate action is required as the JDK's built-in deserialization protections mitigate this class of vulnerability, but upgrading is strongly encouraged. For JDK < 8u121 where serialization filters are unavailable, set the environment variable DD_INTEGRATION_RMI_ENABLED=false to disable the vulnerable RMI instrumentation entirely. Additionally, restrict network access to JMX/RMI ports using firewalls or network ACLs to ensure they are not reachable from untrusted networks (GitHub Advisory).

The vulnerability was responsibly disclosed through Datadog's bug bounty program by researcher Mohamed Amine ait Ouchebou (mrecho) of Indiesecurity, and Datadog published the advisory on March 23, 2026 (Datadog Advisory). The disclosure was noted by automated vulnerability tracking services and security community feeds shortly after publication, with mentions on Mastodon (infosec.exchange) and Bluesky. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.