Red Hat JBoss EAP Artemis permits untrusted deserialization: ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader filtering, but default allow-list and block-list are empty, so isTrustedType() accepts all classes. Network attackers with low privileges can trigger deserialization, impacting confidentiality/integrity/availability. Remediate by applying Red Hat fixes and configuring non-empty allow/block lists.