Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107726— Hazelcast: Arbitrary member memory access by low-privileged client

Quick assessment

Affected
hazelcast hazelcast
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Hazelcast 是一个统一的实时数据平台，将流处理与快速数据存储相结合。在版本 5.4.5、5.5.10 和 5.6.1 之前，若恶意客户端成功连接到集群，由于对输入数据验证不当，攻击者可从集群成员的 Java 堆内存、堆外内存以及 JVM 进程地址空间中任意读取数据。该漏洞同样可能导致集群成员崩溃，并且在某些 Hazelcast 企业版配置中，可能破坏内存并导致任意代码执行。Hazelcast 的 slim（精简）和 full（完整）版本均受影响。此问题已在版本 5.4.5、5.5.10、5.6.1 和 5.

CVSS 9.3 · Critical

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107726

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Hazelcast: Arbitrary member memory access by low-privileged client
Source: CVE Program / CVE List V5
Vulnerability Description
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, and JVM process address space. The same flaw can crash cluster members and, in some Hazelcast Enterprise Edition configurations, corrupt memory with possible arbitrary code execution. Both slim and full distributions are affected. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
hazelcast hazelcast < 5.4.5 -

II. Public POCs for CVE-2026-107726

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107726

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-107726 (1)

Vendor Pages for CVE-2026-107726 (2)

IV. Related Vulnerabilities

Same product: hazelcast
Same vendor: hazelcast
Same weakness: CWE-20

V. Comments for CVE-2026-107726

No comments yet

Leave a comment