CVE-2016-2510: BeanShell Java deserialization remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote code execution with no authentication or interaction required and very high EPSS, though exploitation depends on the target deserializing untrusted data with BeanShell on the classpath.

What it is

BeanShell (bsh) before 2.0b6, when present on the classpath of an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler. Because the flaw lives in a library that many Java applications bundle, any endpoint that deserializes untrusted input while BeanShell is on the classpath is exposed to full code execution.

Impact

An attacker who can supply crafted serialized data gains arbitrary code execution in the context of the affected Java process, which typically means full compromise of the application and its host.

Attack surface

Reached remotely over the network by sending malicious serialized data to an application that deserializes untrusted input and has BeanShell on its classpath; no authentication or user interaction is required per the CVSS vector (AV:N/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.704 probability, 99.4th percentile) and public references include ysoserial and RSA conference material tagged as exploits, indicating mature public tooling.

What to do

• Upgrade BeanShell to 2.0b6 or later, or apply the vendor patches referenced in the advisories.
• Remove BeanShell from the classpath of applications that do not require it.
• Avoid deserializing untrusted data; use safe formats such as JSON with strict type handling and enforce deserialization allowlists.
• Apply the relevant distribution updates (Debian DSA-3504, Ubuntu USN-2923-1, Red Hat RHSA advisories) for packaged deployments.
• Where deserialization of untrusted input is unavoidable, isolate the affected service with network segmentation and least-privilege runtime accounts.

Detection

• Monitor for deserialization of unexpected or attacker-controlled classes, particularly BeanShell-related types such as XThis.Handler, in application and WAF logs.
• Alert on Java processes spawning unusual child processes or making outbound connections shortly after receiving serialized payloads.
• Hunt for known ysoserial gadget payload signatures in inbound request bodies, base64 blobs and serialized streams.
• Inventory Java applications and dependencies to identify any still bundling BeanShell versions before 2.0b6.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.