CVE-2021-21351: XStream deserialization allows remote code execution via crafted XML stream

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.1 with network reachability, high confidentiality, integrity and availability impact, and a very high EPSS score despite no KEV listing.

What it is

XStream before 1.4.16 deserializes untrusted XML without adequate type restrictions, letting a remote attacker load and execute arbitrary code by manipulating the processed input stream. The flaw matters because XStream is embedded in many Java applications and middleware, and the default blacklist-based Security Framework does not block the attack. Only deployments using a strict whitelist of minimal required types are unaffected.

Impact

An attacker who can supply the XML stream gains arbitrary code execution in the context of the Java process, leading to full compromise of the application and potentially the host.

Attack surface

Reached over the network by submitting a crafted serialized XML stream to an endpoint or component that uses XStream for deserialization. The CVSS vector indicates network access with high privileges required and no user interaction; the description does not specify the exact interface.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high (0.82136, 99.6th percentile) and the vendor advisory reference is tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade XStream to 1.4.16 or later, which is the minimum version required when relying on the default blacklist.
• Replace the default blacklist with a whitelist limited to the minimal required types, per XStream's security framework guidance.
• Identify and update or isolate downstream products that bundle XStream, including Apache ActiveMQ, JMeter, NetApp OnCommand Insight, Oracle WebCenter Portal and Oracle banking/communications products.
• Apply vendor patches for Debian, Fedora and Oracle distributions that ship XStream.
• Where patching is not immediate, restrict network access to deserialization endpoints and block untrusted XML input.

Detection

• Monitor application and middleware logs for XStream deserialization errors or unexpected class-loading activity around XML processing endpoints.
• Alert on outbound network connections or process execution spawned by Java services that handle XStream XML input.
• Inventory Java applications and dependencies for XStream versions below 1.4.16, including embedded copies in ActiveMQ and JMeter.
• Watch for XML payloads containing XStream class and field elements referencing unexpected or dangerous types.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.