{"id":"CVE-2026-33728","aliases":["GHSA-579q-h82j-r5v2"],"url":"https://o3.security/vulnerability/CVE-2026-33728","summary":"dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution","details":"In versions of dd-trace-java prior to 1.60.3, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. All three of the following conditions must be true to exploit this vulnerability:\n1. dd-trace-java is attached as a Java agent (`-javaagent`) on Java 16 or earlier\n2. A JMX/RMI port has been explicitly configured via `-Dcom.sun.management.jmxremote.port` and is network-reachable\n3. A gadget-chain-compatible library is present on the classpath\n\n### Impact\nArbitrary remote code execution with the privileges of the user running the instrumented JVM.\n\n### Recommendation\n- For JDK >= 17: No action is required, but upgrading is strongly encouraged.\n- For JDK >= 8u121 < JDK 17: Upgrade to dd-trace-java version 1.60.3 or later.\n- For JDK < 8u121 and earlier where serialization filters are not available, apply the workaround described below.\n\n### Workarounds\nSet the following environment variable to disable the RMI integration: `DD_INTEGRATION_RMI_ENABLED=false`\n\n### Credits\nThis vulnerability was responsibly disclosed by Mohamed Amine ait Ouchebou (mrecho) (Indiesecurity) via the Datadog bug bounty program.","published":"2026-03-27T00:25:56.444Z","modified":"2026-10-28T02:31:14.331387581Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"com.datadoghq:dd-java-agent","fixedVersion":"1.60.3"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/DataDog/dd-trace-java/releases/tag/v1.60.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33728.json"},{"type":"ADVISORY","url":"https://github.com/DataDog/dd-trace-java/security/advisories/GHSA-579q-h82j-r5v2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33728"},{"type":"PACKAGE","url":"https://github.com/DataDog/dd-trace-java"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:14.331387581Z"}}