CVE-2021-21346: XStream deserialization allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction, and public exploit material, though it is not in KEV.

What it is

XStream before 1.4.16 deserializes untrusted XML without adequate type restrictions, letting a remote attacker load and execute arbitrary code by manipulating the processed input stream. It matters because XStream is embedded in many Java applications and middleware, and the default blacklist-based security framework does not block this attack.

Impact

An attacker gains remote code execution in the context of the application processing the XML, which typically means full compromise of that process and its data. No confidentiality, integrity or availability impact is excluded by the CVSS vector.

Attack surface

Reached over the network by submitting crafted XML to any endpoint or message channel that feeds XStream, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is 0.76367 (99.5th percentile) and the vendor reference is tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade XStream to 1.4.16 or later, or apply the vendor patch for the affected product (Oracle, NetApp, Debian, Fedora advisories exist).
• Replace the default blacklist with a whitelist limited to the minimal required types, as the advisory recommends.
• Where XStream cannot be patched, isolate or disable XML deserialization of untrusted input and validate input against a strict schema.
• Inventory applications and middleware that bundle XStream (ActiveMQ, JMeter, Oracle and NetApp products) and track their patched versions.

Detection

• Search application and server logs for XStream deserialization errors or unexpected class-loading exceptions tied to XML input.
• Monitor for outbound network connections or process spawns originating from Java services that handle XML, which can indicate post-exploitation code loading.
• Scan deployed artifacts for XStream versions below 1.4.16 and flag any use of the default blacklist configuration.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.