CVE-2026-107726criticalCWE-20

CVE-2026-107726: fallo crítico en hazelcast

Hazelcast: Arbitrary member memory access by low-privileged client

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear hazelcast+ Monitorear com.hazelcast:hazelcast

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.3epss 0.4%
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, and JVM process address space. The same flaw can crash cluster members and, in some Hazelcast Enterprise Edition configurations, corrupt memory with possible arbitrary code execution. Both slim and full distributions are affected. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
hazelcast · hazelcast
CVEs relacionadas — hazelcast

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-107725HIGHHazelcast: Authorization bypass in IMap Predicates APIEPSS 0.4%