Loading vulnerability…
CVE-2026-6857 is a remote code execution vulnerability in Apache Camel's camel-infinispan component. The flaw is caused by unsafe deserialization in the ProtoStream remote aggregation repository, where untrusted serialized data can be processed without sufficient validation. An attacker with low privileges can send specially crafted data to trigger deserialization of attacker-controlled content, leading to arbitrary code execution within the context of the affected application or host.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone proof-of-concept for CVE-2026-6857, consisting of one Python exploit script plus README/license files. The main file, exploit_cve_2026_6857.py, does not directly exploit a remote service with a full gadget chain; instead it prepares and inserts a crafted JSON payload into an Infinispan cache via the external hotrod-cli utility. The payload is wrapped as org.infinispan.query.remote.impl.indexing.ProtobufValueWrapper and contains a base64-encoded placeholder object, indicating the exploit is incomplete and intended as a staging PoC rather than a turnkey RCE tool. Operationally, the script targets an Infinispan Hot Rod endpoint at a configurable host and port (default 127.0.0.1:11222), writes to a Camel-specific cache name (default CamelAggregationRepository_yourRoute), and stores the object under a chosen key (default exploit_key_001). After insertion, the operator is instructed to send a Camel message with the CamelCorrelationId header set to that key so Camel will retrieve the cache entry and potentially trigger unsafe deserialization. This makes the exploit a multi-step network attack against a Camel/Infinispan integration, dependent on knowing the correct cache name and application flow. Repository structure is minimal: .gitignore, LICENSE, README.md, and the Python script. The README is mostly legal/ethical disclaimer text with a single external reference to a blog post about the vulnerability. There is no framework usage, no detection logic, and no real gadget or command payload embedded, so the code should be classified as a PoC exploit that demonstrates cache injection and trigger conditions rather than reliable end-to-end code execution.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote code execution vulnerability in camel-infinispan caused by unsafe deserialization.
A remote code execution vulnerability in Apache Camel camel-infinispan caused by unsafe deserialization.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.