How severe is CVE-2026-41586?

CVE-2026-41586 has a CVSS 4.0 base score of 9.3, rated critical severity.

Is CVE-2026-41586 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-41586?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2026-41586 have an EU (EUVD) identifier?

Yes. CVE-2026-41586 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-28316.

When was CVE-2026-41586 published?

CVE-2026-41586 was published on 2026-05-07 and last updated on 2026-06-17.

CVE-2026-41586

CVE-2026-41586 is a critical-severity vulnerability with a CVSS 4.0 base score of 9.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-502.

Key facts

Severity: Critical (CVSS 4.0 base score 9.3)
EPSS exploit prediction: 0% (33rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-28316
Weakness: CWE-502
Published: 2026-05-07
Last modified: 2026-06-17

Description

Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.readObject() on untrusted byte arrays without configuring an ObjectInputFilter. This is a classic Java deserialization RCE pattern. At time of publication, there are no publicly available patches.

Frequently asked questions

What is CVE-2026-41586?: Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.readObject() on untrusted byte arrays without configuring an ObjectInputFilter. This is a classic Java deserialization RCE pattern. At time of publication, there are no publicly available patches.
How severe is CVE-2026-41586?: CVE-2026-41586 has a CVSS 4.0 base score of 9.3, rated critical severity.
Is CVE-2026-41586 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-41586?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2026-41586 have an EU (EUVD) identifier?: Yes. CVE-2026-41586 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-28316.
When was CVE-2026-41586 published?: CVE-2026-41586 was published on 2026-05-07 and last updated on 2026-06-17.

References

Other CWE-502 (Deserialization of Untrusted Data) vulnerabilities

CVE-2026-41104 — Critical (CVSS 10.0): Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose…
CVE-2026-43633 — Critical (CVSS 10.0): HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a…
CVE-2026-33819 — Critical (CVSS 10.0): Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network.
CVE-2026-20131 — Critical (CVSS 10.0): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could…
CVE-2026-25632 — Critical (CVSS 10.0): EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water…
CVE-2025-14931 — Critical (CVSS 10.0): Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability.…

Browse all CWE-502 (Deserialization of Untrusted Data) vulnerabilities →