{"id":"CVE-2021-39144","published":"2021-08-23T18:15:12Z","modified":"2026-06-17T04:03:09Z","title":"XStream Remote Code Execution Vulnerability","vendor":"XStream","product":"XStream","tier":"core","eol":null,"description":{"text":"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.","provenance":"source","from":"NVD"},"summary":{"text":"XStream, a Java library for serializing objects to XML and back, contains a remote code execution flaw in its deserialization handling, which in affected versions lets input streams be manipulated to run commands on the host. An attacker needs sufficient rights and must be able to supply crafted input to the processing stream over the network, with the attack complexity being high, while deployments that configured XStream's security framework with a whitelist of only the minimal required types are not affected.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:17Z"},"cvss":{"score":8.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.98124,"percentile":0.99912,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2023-03-10","dueDate":"2023-03-31","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://www.vmware.com/security/advisories/VMSA-2022-0027.html, https://x-stream.github.io/CVE-2021-39144.html; https://nvd.nist.gov/vuln/detail/CVE-2021-39144","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-03-08","exploitedFirstSeen":"2023-03-08","ransomware":false,"evidence":[{"url":"https://lab.wallarm.com/vmware-nsx-manager-vulnerabilities-being-actively-exploited-in-the-wild/","date":"2023-03-08"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-03-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-31&host_type=src&vulnerability=cve-2021-39144","date":"2023-12-31"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2021-39144","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-23&host_type=src&vulnerability=cve-2021-39144","date":"2024-01-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2021-39144","date":"2024-01-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-25&host_type=src&vulnerability=cve-2021-39144","date":"2024-01-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-26&host_type=src&vulnerability=cve-2021-39144","date":"2024-01-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-27&host_type=src&vulnerability=cve-2021-39144","date":"2024-01-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-28&host_type=src&vulnerability=cve-2021-39144","date":"2024-01-28"}],"evidenceTotal":399,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"},{"id":"CWE-502","name":"Deserialization of Untrusted Data"},{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"http://packetstormsecurity.com/files/169859/VMware-NSX-Manager-XStream-Unauthenticated-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh","tags":["Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/","tags":["Broken Link","Mailing List","Release Notes"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/","tags":["Broken Link","Mailing List","Release Notes"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/","tags":["Broken Link","Mailing List","Release Notes"]},{"url":"https://security.netapp.com/advisory/ntap-20210923-0003/","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2021/dsa-5004","tags":["Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["Patch","Third Party Advisory"]},{"url":"https://x-stream.github.io/CVE-2021-39144.html","tags":["Exploit","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/169859/VMware-NSX-Manager-XStream-Unauthenticated-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh","tags":["Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/","tags":["Broken Link","Mailing List","Release Notes"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/","tags":["Broken Link","Mailing List","Release Notes"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/","tags":["Broken Link","Mailing List","Release Notes"]},{"url":"https://security.netapp.com/advisory/ntap-20210923-0003/","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2021/dsa-5004","tags":["Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["Patch","Third Party Advisory"]},{"url":"https://x-stream.github.io/CVE-2021-39144.html","tags":["Exploit","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-39144","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"exploitation_technique","evidence":[],"comment":"The vulnerability allows a remote attacker to execute arbitrary code on the target system. It exists due to the deserialization of untrusted data in XStream versions up to 1.4.18. A remote attacker can exploit this by sending a specially crafted XStream marshalled payload to an endpoint in VMware NSX Manager, which uses the vulnerable xstream-1.4.18.jar package. Successful exploitation of this vulnerability may result in complete compromise of the vulnerable system, allowing execution of commands with root privileges.\n\n","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"The vulnerability allows a remote attacker to execute arbitrary code on the target system. It exists due to the deserialization of untrusted data in XStream versions up to 1.4.18. A remote attacker can exploit this by sending a specially crafted XStream marshalled payload to an endpoint in VMware NSX Manager, which uses the vulnerable xstream-1.4.18.jar package. Successful exploitation of this vulnerability may result in complete compromise of the vulnerable system, allowing execution of commands with root privileges.\n\n","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"}],"reports":[],"affected":[{"ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","vulnerableRanges":["<1.4.18"],"patched":["1.4.18"],"from":["GHSA-j9h8-phrw-h4fh"],"provenance":"source"}],"advisories":[{"id":"GHSA-j9h8-phrw-h4fh","url":"https://github.com/advisories/GHSA-j9h8-phrw-h4fh","severity":"HIGH","ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","vulnerableRanges":["<1.4.18"],"patched":["1.4.18"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-1771","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1771","exploited":true,"exploitedSince":"2023-03-10","provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"VMware NSX Manager XStream unauthenticated RCE","module":"exploit/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144","type":"exploit","disclosureDate":"2022-10-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb"}],"nuclei":[{"id":"CVE-2021-39144","name":"XStream 1.4.18 - Remote Code Execution","severity":"high","path":"http/cves/2021/CVE-2021-39144.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39144.yaml"}],"first":{"date":"2022-10-25","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/169859/VMware-NSX-Manager-XStream-Unauthenticated-Remote-Code-Execution.html","https://x-stream.github.io/CVE-2021-39144.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"related","techniques":["T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2021-08-23","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39144","provenance":"source"},{"date":"2022-10-25","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb","provenance":"source"},{"date":"2023-03-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://lab.wallarm.com/vmware-nsx-manager-vulnerabilities-being-actively-exploited-in-the-wild/","provenance":"source"},{"date":"2023-03-10","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-03-10","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1771","provenance":"source"}],"speed":{"daysToPublicExploit":428,"firstExploitFrom":"Metasploit","daysToKev":564},"priority":{"score":68.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1333 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9991"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.95,"detail":"base score 8.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}