CVE-2026-33728: dd-trace-java RMI RCE Vulnerability

CVE-2026-33728 Overview

CVE-2026-33728 is a critical insecure deserialization vulnerability affecting Datadog's dd-trace-java APM client. The vulnerability exists in the RMI instrumentation component, which registered a custom endpoint that deserializes incoming data without applying serialization filters. On JDK version 16 and earlier, an attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this vulnerability to achieve remote code execution.

Critical Impact

Remote attackers can achieve arbitrary code execution on vulnerable Java applications using dd-trace-java versions 0.40.0 through 1.60.2 when specific conditions are met, potentially leading to complete system compromise.

Affected Products

• dd-trace-java versions 0.40.0 through 1.60.2
• Java applications running on JDK 16 or earlier with dd-trace-java agent attached
• Systems with JMX/RMI ports explicitly configured and network-accessible

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-33728 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-33728

Vulnerability Analysis

This insecure deserialization vulnerability (CWE-502) stems from the dd-trace-java library's RMI instrumentation module failing to implement proper serialization filters when processing incoming data. The vulnerability requires three conditions to be exploitable: the dd-trace-java agent must be attached via -javaagent on Java 16 or earlier, a JMX/RMI port must be explicitly configured via -Dcom.sun.management.jmxremote.port and be network-reachable, and a gadget-chain-compatible library must be present on the classpath.

The attack surface is network-accessible (AV:N), requires no authentication or user interaction, and can result in complete compromise of confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause lies in the custom RMI endpoint implementation within dd-trace-java's instrumentation code. When processing incoming RMI connections, the endpoint deserializes data without applying Java's serialization filtering mechanisms. This allows malicious serialized objects to be instantiated, which—when combined with common Java gadget chains from libraries like Apache Commons Collections or Spring—can lead to arbitrary code execution.

Attack Vector

The attack requires network access to the JMX or RMI management port of a vulnerable application. An attacker would craft a malicious serialized Java object containing a gadget chain that triggers code execution upon deserialization. When this payload is sent to the exposed RMI endpoint registered by dd-trace-java, the lack of serialization filters allows the malicious object to be instantiated, executing the attacker's code with the privileges of the Java application.

The exploitation typically leverages well-known Java deserialization gadget chains. Tools like ysoserial can generate payloads that exploit common library classes present on the classpath to achieve remote code execution. The vulnerability is particularly dangerous because many Java applications include libraries that contain exploitable gadget chains.

Detection Methods for CVE-2026-33728

Indicators of Compromise

• Unusual network connections to JMX/RMI ports (typically 1099 or custom configured ports) from external or unexpected sources
• Unexpected process spawning or command execution from Java application processes
• Suspicious serialized Java object payloads in network traffic to RMI endpoints
• Anomalous activity following RMI deserialization events in application logs

Detection Strategies

• Monitor network traffic for connections to JMX/RMI ports from unauthorized sources
• Implement application-level logging to detect deserialization events and potential gadget chain execution patterns
• Use endpoint detection to identify unusual child processes spawned by Java applications
• Deploy network intrusion detection rules to identify serialized Java object payloads characteristic of exploitation tools

Monitoring Recommendations

• Enable verbose logging on JMX/RMI interfaces to capture connection attempts and deserialization events
• Implement alerting for any external network access to JMX/RMI management ports
• Monitor for indicators of common post-exploitation activities such as reverse shells or credential harvesting

How to Mitigate CVE-2026-33728

Immediate Actions Required

• Upgrade dd-trace-java to version 1.60.3 or later for JDK versions 8u121 through 16
• For JDK versions prior to 8u121, apply the workaround by disabling RMI integration
• Restrict network access to JMX/RMI ports using firewall rules
• Audit applications for the presence of gadget-chain-compatible libraries on the classpath

Patch Information

Datadog has released dd-trace-java version 1.60.3 which addresses this vulnerability by implementing proper serialization filters on the RMI endpoint. For applications running on JDK 17 or later, the vulnerability is not exploitable due to built-in JDK protections, but upgrading is still strongly recommended. The security fix is documented in the GitHub Security Advisory and the patched release is available from the GitHub releases page.

Workarounds

• Set the environment variable DD_INTEGRATION_RMI_ENABLED=false to disable the vulnerable RMI integration
• Ensure JMX/RMI ports are not exposed to untrusted networks by configuring appropriate firewall rules
• Remove unnecessary gadget-chain-compatible libraries from the application classpath where possible

# Configuration example - Disable RMI integration via environment variable
export DD_INTEGRATION_RMI_ENABLED=false

# Alternatively, restrict JMX/RMI to localhost only
java -Dcom.sun.management.jmxremote.host=127.0.0.1 \
     -Dcom.sun.management.jmxremote.port=9999 \
     -Dcom.sun.management.jmxremote.ssl=true \
     -Dcom.sun.management.jmxremote.authenticate=true \
     -javaagent:/path/to/dd-java-agent.jar \
     -jar your-application.jar