Other information and services of the government: www.belgium.be Centre for Cybersecurity Belgium
search

Warning: Critical Remote Code Execution in Talend JobServer and Talend Runtime. Patch Immediately!

Image
Decorative image
Published : 14/04/2026
  • Last update: 14/04/2026
  • Affected software:
    → Talend JobServer
    . Version 7.3 (before TPS-6018)
    . Version 8.0 (before TPS-6017)
    → Talend Runtime
    . Version 7.3 (before 7.3.1-R2026-01)
    . Version 8.0 (before 8.0.1.R2026-01-RT)
  • Type: Deserialization of Untrusted Data
  • CVE/CVSS
    → CVE-2026-6264: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Sources

NVD - https://nvd.nist.gov/vuln/detail/CVE-2026-6264

Risks

Talend JobServer and Talend Runtime are core components of the Talend data integration platform:

  • JobServer executes scheduled or on‑demand data processing jobs.
  • Talend Runtime provides a container for running real‑time integration services, APIs, and messaging workflows.

They are widely deployed in enterprise settings as part of critical data pipelines, thus vulnerabilities in these components pose a high risk and may lead to widespread compromise across enterprise environments.

Several versions are affected by CVE-2026-6264, a critical deserialization of untrusted data vulnerability. An attacker can exploit this vulnerability to:

  • Execute arbitrary code remotely.
  • Gain full control over affected systems.
  • Access, modify, or delete sensitive data.
  • Disrupt services and data processing workflows.

Description

CVE-2026-6264 is a critical vulnerability (CVSS 9.8) that allows unauthenticated remote code execution via the JMX monitoring port exposed by Talend JobServer and Talend Runtime. The JMX monitoring interface can be abused to inject malicious serialised data, which is then deserialised without adequate validation.

This vulnerability is remotely exploitable over the network, requires no authentication, no privileges, and no user interaction, and can result in complete system compromise with full access to confidentiality, integrity, and availability.

Recommended Actions

Patch
The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable instances with the highest priority after thorough testing.

For Talend JobServer, the patch must be applied for full mitigation. For Talend Runtime, the vulnerability is mitigated by disabling the JobServer JMX monitoring port, which is disabled by default from the R2024-07-RT patch and later versions.

Monitor/Detect
The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity and ensure a swift response in case of an intrusion

In case of an intrusion, you can report an incident via https://ccb.belgium.be/en/cert/report-incident.

While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.

References

NVD - https://nvd.nist.gov/vuln/detail/CVE-2026-6264
Github - <https://github.com/advisories/GHSA-2m83-cjg7-5x73>
Qlik - https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fix-for-the-Qlik-Talend-JobServer-and-Talend/tac-p/2541974