Vulnary
← back to the feed
Critical· 9.8official fix available

CVE-2026-47065

CVE-2026-47065 is a critical deserialization vulnerability in Apache Mina affecting versions 2.0.29, 2.1.13, and 2.2.8. It allows attackers to bypass class filters and trigger static initializers via crafted serialized streams, leading to remote code execution. Both issues described have been fixed.

publishedJun 3, 2026
last modifiedJul 22, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
<1%
40th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 24, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

01

Who is affected

Users of Apache Mina 2.0.29, 2.1.13, or 2.2.8.

02

Real-world impact

An attacker can send malicious serialized data to trigger arbitrary class loading and static initializer execution, potentially achieving full system compromise.

03

Why this severity

CVSS v3.1 base score 9.8 (Critical) due to network‑adjacent attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

04

What to do about it

official fix available
recommended steps
  1. 01Upgrade Apache Mina to a patched version (the vendor has fixed the issue; consult the Apache Mina advisory for the exact version).

NVD description states both issues have been fixed.

05

Timeline

  1. Jun 3, 2026 · Jun 3, 2026
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Jul 22, 2026 · 13d ago
    Advisory updated
    The NVD record was last revised.
  3. Jul 25, 2026 · 11d ago
    Official fix available
    A vendor patch or mitigation now exists — see the remediation steps above.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07

References & advisories

NVD advisory ↗Search advisories ↗
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →