CVE-2026-64606 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-64606 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-64606 is a critical deserialization vulnerability in Apache Fory affecting Java lambda capture class deserialization, where class-registration checks may be bypassed when processing untrusted serialized data.

Technical Detail

The flaw occurs during Java lambda deserialization and is limited to lambda capture classes. An attacker who can cause an affected Apache Fory deployment to deserialize attacker-controlled data may bypass intended class-registration restrictions. Successful exploitation could permit unsafe object deserialization and may lead to remote code execution, depending on the application’s deserialization configuration and available classes.

Exploitation Status

No known exploit has been reported as of July 28, 2026. This CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog.

Who Is Targeting This

No specific threat actor attribution at this time.

What To Do

Prioritize updating Apache Fory to a vendor-provided fixed release when one is available and review Apache security advisories for version-specific remediation guidance. Do not deserialize data from untrusted or insufficiently authenticated sources, and do not rely solely on class-registration controls to protect Java lambda deserialization. Restrict access to services and endpoints that accept serialized data, apply network-level access controls where feasible, and review application logs for unexpected deserialization errors, unusual lambda-related class loading, or requests containing serialized payloads. No vendor workaround or specific detection signature is confirmed in the available information.