Critical severity · published Oct 8, 2026
CVE-2026-107726
Hazelcast: Arbitrary member memory access by low-privileged client
9.3
CVSS
0.4%
EPSS
No
On KEV
Description
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, and JVM process address space. The same flaw can crash cluster members and, in some Hazelcast Enterprise Edition configurations, corrupt memory with possible arbitrary code execution. Both slim and full distributions are affected. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
hazelcast · hazelcast
< 5.4.5; >= 5.5.0, < 5.5.10; >= 5.6.0, < 5.6.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107726
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107726
x_refsource_CONFIRM
https://github.com/hazelcast/hazelcast/security/advisories/GHSA-6v25-8wq6-xq4j
x_refsource_MISC
https://github.com/hazelcast/hazelcast/commit/361979da12f18950c24719db832ca6c5e7c0534f
x_refsource_MISC
https://docs.hazelcast.com/hazelcast/5.7/release-notes/community
x_refsource_MISC
https://docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise
x_refsource_MISC
https://github.com/hazelcast/hazelcast/releases/tag/v5.7.0
More from hazelcast
9.8
CVE-2022-0265
Improper Restriction of XML External Entity Reference in hazelcast/hazelcast
9.8
CVE-2020-26168
The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly the password in some…
9.1
CVE-2022-36437
The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already…
8.8
CVE-2023-33265
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on…
8.7
CVE-2026-107725
Hazelcast: Authorization bypass in IMap Predicates API