---
id: 6756
title: "Log4j FilteredObjectInputStream Bypass: Pre-auth RCE via MarshalledObject"
cvss: 9.8
severity: critical
vendor: "Apache"
product: "Log4j 2"
affected_versions: "log4j-api 2.11.0–2.24.3, log4j-core 2.8.0–2.24.3"
source_domain: github.com
source_url: "https://github.com/hypnguyen1209/log4j2-rce"
published_at: "2026-08-26T15:44:51Z"
tags: ["rce", "public-poc", "java", "deserialization", "pre-auth", "authentication", "vulnerability", "log4j", "apache", "commons-collections", "serialization", "poc", "filteredobjectinputstream", "marshalledobject"]
phying_url: "https://phying.com/item/6756"
lang: en
---

# Log4j FilteredObjectInputStream Bypass: Pre-auth RCE via MarshalledObject

## Summary

Pre-auth RCE on Java services deserializing LogEvent: Log4j's FOIS allowlist falls to LogEventProxy's MarshalledObject, whose .get() opens an unfiltered stream, executing hidden CC6 gadget chains.

## Why it matters

This PoC demonstrates an unexpected filter-bypass gadget in Log4j 2, emphasizing the danger of unauthenticated serialized object ingestion.

## Intelligence Metadata

- **Sources:** github.com
- **CVSS:** 9.8
- **Vendor:** Apache
- **Product:** Log4j 2
- **Affected versions:** log4j-api 2.11.0–2.24.3, log4j-core 2.8.0–2.24.3
- **Published:** 2026-08-26T15:44:51Z
- **Original:** https://github.com/hypnguyen1209/log4j2-rce
- **Phying News:** https://phying.com/item/6756