{"id":"CVE-2026-33728","aliases":["GHSA-579q-h82j-r5v2"],"url":"https://o3.security/vulnerability/CVE-2026-33728","summary":"dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution","details":"dd-trace-java is a Datadog APM client for Java. In versions of dd-trace-java 0.40.0 through prior to 1.60.2, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability: First, dd-trace-java is attached as a Java agent (`-javaagent`) on Java 16 or earlier. Second, a JMX/RMI port has been explicitly configured via `-Dcom.sun.management.jmxremote.port` and is network-reachable, Third, a gadget-chain-compatible library is present on the classpath. For JDK >= 17, no action is required, but upgrading is strongly encouraged. For JDK >= 8u121 < JDK 17, upgrade to dd-trace-java version 1.60.3 or later. For JDK < 8u121 and earlier where serialization filters are not available, apply the workaround. The workaround is to set the following environment variable to disable the RMI integration: `DD_INTEGRATION_RMI_ENABLED=false`.","published":"2026-03-27T00:25:56.444Z","modified":"2026-08-12T03:51:25.264553067Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"com.datadoghq:dd-java-agent","fixedVersion":"1.60.3"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/DataDog/dd-trace-java/releases/tag/v1.60.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33728.json"},{"type":"ADVISORY","url":"https://github.com/DataDog/dd-trace-java/security/advisories/GHSA-579q-h82j-r5v2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33728"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:25.264553067Z"}}