{"vulnerability": "cve-2026-43865", "sightings": [{"uuid": "64bbcbf8-ec97-4c85-aee3-0cd8624c9ddb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43865", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mpwdlgokiu2l", "content": "CVE-2026-43865: Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution", "creation_timestamp": "2026-07-05T19:44:29.566474Z"}, {"uuid": "f86cb3a2-fe4c-4ca2-86e3-8335495976f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-43865", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116873273590366771", "content": "CVE-2026-43865 (CRITICAL): Apache Camel Hazelcast component deserializes untrusted data by default, enabling RCE if attacker accesses the cluster. Patch: 4.21.0, 4.18.3, or 4.14.8. Harden configs if upgrade isn't possible. https://radar.offseq.com/threat/cve-2026-43865-cwe-502-deserialization-of-untruste-d2e34a1a7ce10b73 #OffSeq #CVE #ApacheCamel", "creation_timestamp": "2026-07-06T13:30:29.571828Z"}, {"uuid": "157f35db-d66e-4c12-ae22-1bda824367e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-43865", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mpy75nbykh24", "content": "Apache Camel flaw (CRITICAL): Hazelcast deserialization bug enables RCE if attacker joins cluster. Affects 4.0.0 \u2013 4.14.7, 4.15.0 \u2013 4.18.2, 4.19.0 \u2013 4.20.x. Upgrade or harden Hazelcast config now. https://radar.offseq.com/threat/cve-2026-43865-cwe-502-deserialization-of-untruste-d2e34a1a7ce10b73 ...", "creation_timestamp": "2026-07-06T13:30:31.622123Z"}, {"uuid": "5c3e90bb-8999-44c6-8d33-5caac928e722", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43865", "type": "seen", "source": "https://t.me/GithubRedTeam/93076", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-43865\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-12 09:31:57\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-43865 \u2014 Apache Camel camel-hazelcast default-configured instance unsafe Java deserialization (RCE)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:03.959209Z"}, {"uuid": "b6400aac-82c8-4b0f-9708-0bb7ca080630", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43865", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93076", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-43865\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-12 09:31:57\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-43865 \u2014 Apache Camel camel-hazelcast default-configured instance unsafe Java deserialization (RCE)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:08.898688Z"}, {"uuid": "1486b40a-33a1-49c8-8201-144db0f071c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43865", "type": "seen", "source": "Telegram/tYmsElsn9h--aUiAjXnDcQx9kxldzvlWhq7A7UpXPwomXD0", "content": "", "creation_timestamp": "2026-07-16T19:00:11.151028Z"}, {"uuid": "efa1e283-5f4e-4040-9cc8-025d7f23290e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43865", "type": "seen", "source": "Telegram/tYmsElsn9h--aUiAjXnDcQx9kxldzvlWhq7A7UpXPwomXD0", "content": "", "creation_timestamp": "2026-07-17T00:00:26.761956Z"}, {"uuid": "83527de5-b569-40dd-9f51-31e68de8fc77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43865", "type": "published-proof-of-concept", "source": "Telegram/tYmsElsn9h--aUiAjXnDcQx9kxldzvlWhq7A7UpXPwomXD0", "content": "", "creation_timestamp": "2026-07-18T00:00:45.597700Z"}, {"uuid": "34d8d6d6-51ed-49d3-aad3-2e9393a8acbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43865", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mr753aysef23", "content": "\ud83d\udccc CVE-2026-43865 - Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component.\n\nThe camel-hazelcast component creates and manages Hazelcast inst... https://www.cyberhub.blog/cves/CVE-2026-43865", "creation_timestamp": "2026-07-22T01:07:13.782373Z"}]}