Security readout for executives and security teams
Plain-English summary
Apache Camel LevelDB can execute attacker-supplied code when an application reads malicious serialized data from its aggregation database. Exploitation requires a path to write into the LevelDB files, but successful exploitation could fully compromise the Camel application and its accessible data and services.
Executive priority
Prioritize immediate remediation for affected systems with untrusted or broadly shared write access to LevelDB storage. Other affected deployments should enter an accelerated patch cycle because successful exploitation provides application-level code execution with high confidentiality, integrity, and availability impact.
Technical view
DefaultLevelDBSerializer uses java.io.ObjectInputStream without an ObjectInputFilter or class-loading restrictions. A crafted Java object placed in the LevelDB aggregation repository may be deserialized during normal operations, causing arbitrary code execution with the application process's privileges.
Likely exposure
Exposure exists where affected camel-leveldb versions operate a LevelDB aggregation repository and an attacker can modify its database files. Relevant write paths may include compromised accounts, services, shared storage, or permission weaknesses. Internet exposure alone does not establish the required database-write capability.
Exploitation context
The CVE is not listed in KEV. An exploit-tagged public GitHub reference is provided, but the source bundle does not establish exploit reliability or active in-the-wild exploitation. Treat accessible LevelDB write paths as the primary risk multiplier.
Researcher notes
The bundle contains version ambiguity: its narrative says 4.10.0 before 4.10.8 is affected, yet recommends 4.10.9; the structured affected data also lists 3.0.0 inconsistently. Use the vendor advisory and recommended target versions when making final applicability decisions.
Mitigation direction
- Upgrade 4.10.x deployments to 4.10.9, following the vendor recommendation.
- Upgrade 4.14.x deployments to 4.14.5.
- Upgrade versions from 4.15.0 through pre-4.18.0 to 4.18.0.
- Restrict LevelDB file and directory writes to the minimum required application identity.
- Investigate and remove unintended services, users, or shared storage paths that can modify the repository.
Validation and detection
- Inventory deployments containing org.apache.camel:camel-leveldb and record their resolved versions.
- Confirm whether each deployment uses a LevelDB aggregation repository and DefaultLevelDBSerializer.
- Review filesystem, container-volume, and service permissions for every path capable of modifying LevelDB data.
- Check LevelDB files and application telemetry for unexplained changes or execution anomalies.
- After upgrading, verify the resolved package version and exercise normal aggregation operations.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-502: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-25747 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9CISA-ADPCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-02-23T10:02:59.152Z: Reported to Red Hat.
- 2026-02-23T08:45:45.826Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/oscerd/CVE-2026-25747CVE reference, apache · exploit
- https://camel.apache.org/security/CVE-2026-25747.htmlCVE reference, apache · vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-25747CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2441910CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25747.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Deserialization of Untrusted Data
Deserialization of Untrusted Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.