Patch Forecast
Amber warning
Patch this week.

CVE-2026-107726 · GHSA-6v25-8wq6-xq4j

Hazelcast allows arbitrary member memory access by low-privileged client

Risk score
72/100
CVSS
9.3 v4.0
Exploit chance (30 days)
0.4%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, and JVM process address …
Affected
com.hazelcast:hazelcast (maven) = 5.6.0; com.hazelcast:hazelcast (maven) >= 5.5.0, < 5.5.10; com.hazelcast:hazelcast (maven) < 5.4.5
Fix
Upgrade com.hazelcast:hazelcast to 5.7.0 or later.
Exploitation
No known exploitation

Story map

Story map: com.hazelcast:hazelcastTHE FLAWSTHE FIXCVE-2026-107726Hazelcast allows arbitrarymember memory access bylow-privileged clientCVSS 9.3 · EPSS 0%CVE-2026-107725Hazelcast has an authorizationbypass in IMap Predicates APICVSS 8.7 · EPSS 0%Upgrade…5.4.5 · 5.5.10 · 5.6.1 · 5.7.0or later on your release lineWho is exposedcom.hazelcast:hazelcast(maven) = 5.6.0;com.hazelcast:hazelcast(maven) >= 5.5.0, < 5.5.10;com.hazelcast:hazelcast…AMBER · PATCH THIS WEEKcom.hazelcast:hazelcastHazelcast is a unified real-timedata platform combining streamprocessing with a fast datastore. Prior to 5.4.5, 5.5.10, and5.6.1, improper validation of datasupplied by a malicious clientable to connect to a cluster…Where it standsNo known exploitationCONNECTS TOSame weaknessMissing authorisation (CWE-862)399 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

com.hazelcast:hazelcast: Amber, patch this week. Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, and JVM process address …

The flaws

  • CVE-2026-107726: Hazelcast allows arbitrary member memory access by low-privileged client (CVSS 9.3 · EPSS 0%)
  • CVE-2026-107725: Hazelcast has an authorization bypass in IMap Predicates API (CVSS 8.7 · EPSS 0%)

The fix

Upgrade com.hazelcast:hazelcast: 5.4.5 · 5.5.10 · 5.6.1 · 5.7.0 or later on your release line

Who is exposed: com.hazelcast:hazelcast (maven) = 5.6.0; com.hazelcast:hazelcast (maven) >= 5.5.0, < 5.5.10; com.hazelcast:hazelcast (maven) < 5.4.5

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 9.3 critical
  • Remotely exploitable without logging in
  • On your watchlist: Maven

Affected packages

PackageEcosystemVulnerableFixed in
com.hazelcast:hazelcastmaven= 5.6.05.7.0
com.hazelcast:hazelcastmaven>= 5.5.0, < 5.5.105.7.0
com.hazelcast:hazelcastmaven< 5.4.55.7.0

References

Original description

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, and JVM process address space. The same flaw can crash cluster members and, in some Hazelcast Enterprise Edition configurations, corrupt memory with possible arbitrary code execution. Both slim and full distributions are affected. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.

Last activity 8 Oct 2026. Patch Forecast updates every hour.