CVE-2021-21344: XStream deserialization allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, remote code execution impact, and an EPSS probability above 0.75 despite no KEV listing.

What it is

XStream before 1.4.16 deserializes untrusted XML without adequate type restrictions, letting a remote attacker craft a stream that loads and executes arbitrary code from a remote host. The flaw matters because XStream is embedded in many Java applications and middleware, so any endpoint that parses attacker-supplied XML is a potential entry point. Deployments that configured the security framework with a minimal whitelist are not affected; those relying on the default blacklist must upgrade to at least 1.4.16.

Impact

An unauthenticated remote attacker can execute arbitrary code in the context of the application, leading to full compromise of confidentiality, integrity and availability. The CVSS vector rates all three impacts as high.

Attack surface

Reached over the network by submitting a manipulated XML input stream to any XStream-based deserialization endpoint; the CVSS vector shows no privileges and no user interaction required. The description does not enumerate specific exposed endpoints, so defenders must identify where XStream processes untrusted XML in their own deployments.

Exploitation

Not listed in CISA KEV and no ransomware groups are documented using it, but EPSS is 0.7598 (99.5th percentile), indicating a high predicted likelihood of exploitation activity. The vendor advisory reference is tagged Exploit, and a mitigation workaround reference is also provided.

What to do

• Upgrade XStream to version 1.4.16 or later, which is the minimum version required when relying on the default blacklist.
• Apply vendor patches for the listed downstream products (Apache ActiveMQ, JMeter, NetApp OnCommand Insight, Oracle WebCenter Portal and others) rather than patching XStream alone.
• Configure XStream's security framework with a whitelist limited to the minimal required types, which the advisory states leaves users unaffected.
• If upgrading is not immediately possible, apply the vendor-documented workaround referenced in the XStream security page.
• Inventory all applications and middleware that bundle XStream and confirm which ones parse untrusted XML.
• Restrict network access to XML-processing endpoints until patched.

Detection

• Monitor application and WAF logs for XML payloads containing XStream class references or unusual type tags in deserialization requests.
• Alert on outbound network connections or process execution spawned by Java services that handle XML input.
• Search deployed artifacts for bundled XStream versions below 1.4.16 and correlate with internet-facing services.
• Watch for repeated malformed or oversized XML requests to the same endpoint, which may indicate exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.