CVE-2026-41635 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-41635 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-41635 is a deserialization security control bypass vulnerability in Apache MINA's AbstractIoBuffer.resolveClass() method that allows an attacker to instantiate arbitrary classes by circumventing the configured classname allowlist.

Technical Detail

The flaw exists in a conditional branch within AbstractIoBuffer.resolveClass() that handles static classes and primitive types without performing any classname validation against the configured allowlist, effectively leaving that code path unguarded. An attacker who can supply a crafted serialized payload to an Apache MINA endpoint can exploit this branch to cause the deserialization of an arbitrary class outside the intended allowlist. Depending on the classes available on the target's classpath, this could result in remote code execution, making the vulnerability particularly severe in environments with common Java gadget libraries present.

Exploitation Status

No known exploit code has been publicly observed or confirmed as of May 4, 2026. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Despite the absence of confirmed exploitation, the critical CVSS score of 9.8 and the nature of the flaw warrant prompt remediation without waiting for active exploitation to be confirmed.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability. Given the widespread use of Apache MINA in networked Java applications and middleware, opportunistic exploitation by actors scanning for deserialization endpoints is a plausible risk once exploit code matures.

What To Do

Organizations using Apache MINA should identify all deployments of the affected library and apply the vendor-supplied patch as soon as it becomes available, treating this as a high-priority remediation given the critical severity rating. As an interim measure, restrict network access to MINA-based services to trusted sources only, and audit application classpaths to remove or isolate known Java deserialization gadget libraries such as Commons Collections. Monitor deserialization activity and application logs for unexpected class instantiation events. Track the Apache MINA security advisory page for patch release details and version guidance.