CVE-2024-54676: Apache OpenMeetings OpenJPA deserialization of untrusted data

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction, and high EPSS probability make this a critical patching priority.

What it is

Apache OpenMeetings versions from 2.1.0 before 8.0.0 ship default clustering instructions that omit OpenJPA serialization class white/black lists, allowing deserialization of untrusted data. Because the flaw is reachable over the network without authentication and can lead to code execution, it is a serious risk for any deployment using the documented clustering setup.

Impact

An attacker can supply crafted serialized data that OpenJPA deserializes, potentially achieving remote code execution with the privileges of the OpenMeetings process. This can lead to full compromise of the application server and any data it holds.

Attack surface

The CVSS vector is AV:N/AC:L/PR:N/UI:N, so the flaw is network-reachable with no authentication and no user interaction required. It applies to deployments that follow the default clustering instructions, where OpenJPA deserialization endpoints are exposed.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is 0.64935 (99.2nd percentile), indicating a high predicted likelihood of exploitation activity.

What to do

• Upgrade Apache OpenMeetings to version 8.0.0 or later.
• Update startup scripts to set openjpa.serialization.class.blacklist and openjpa.serialization.class.whitelist as shown in the vendor documentation.
• Restrict network access to OpenMeetings clustering ports to trusted hosts only.
• If clustering is not required, disable it to remove the exposed deserialization path.
• Monitor vendor advisories for further guidance on OpenJPA serialization hardening.

Detection

• Inspect OpenMeetings startup scripts and configuration for missing or empty openjpa.serialization.class.blacklist and whitelist settings.
• Monitor network traffic to clustering ports for unexpected serialized payloads or connections from untrusted sources.
• Watch application and JVM logs for OpenJPA deserialization errors or class-loading anomalies.
• Alert on process creation or outbound connections from the OpenMeetings server that deviate from normal behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.