Loading vulnerability…
Apache Causeway ViewModel Java Deserialization RCE
CVE-2025-64408 is a remote code execution vulnerability in Apache Causeway caused by unsafe Java deserialization in the framework's ViewModel functionality. According to the provided content, user-controllable URL parameters can reach deserialization logic, allowing crafted serialized data to be processed by the application. The issue affects all current versions of Apache Causeway prior to the fixed release. Successful exploitation allows an authenticated attacker to execute arbitrary code in the context of the vulnerable application.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in authenticated remote code execution. An attacker can run arbitrary code with the privileges of the affected Apache Causeway application, which may enable full compromise of the application instance, access to application data, further post-exploitation activity from the application context, and potential service disruption or lateral movement depending on the application's privileges and environment.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure of the vulnerable ViewModel functionality and any associated routes that accept user-controllable URL parameters. Restrict access to affected application paths to trusted users and networks, enforce strong authentication and authorization, and minimize the number of users able to reach the vulnerable functionality. Additional compensating controls may include placing the application behind network access controls or reverse proxies that limit access to the affected endpoints until the upgrade can be completed.
Patch, then assume compromise.
Upgrade Apache Causeway to version 3.5.0 or later, which is identified in the provided content as the release that fixes this issue. Because the content states that all current versions are affected, organizations should prioritize upgrading all deployments that use Causeway ViewModel functionality. After upgrading, validate that affected endpoints no longer accept unsafe deserialization input and review application exposure for any residual risk.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.