CVE-2026-15564

Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization

CVSS 3.1 7.4 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-15564

Published

Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and depending on the potential gadget chains available in the running classpath.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-15564

Published

wildfly-iiop-openjdk

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat JBoss Enterprise Application Platform 8.1",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "defaultStatus": "unaffected",
                    "packageName": "wildfly-iiop-openjdk",
                    "cpes": [
                        "cpe:/a:redhat:jboss_enterprise_application_platform:8.1"
                    ]
                }

wildfly-ejb3

https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat JBoss Enterprise Application Platform 7",
                    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
                    "packageName": "wildfly-ejb3",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:jboss_enterprise_application_platform:7"
                    ]
                }

wildfly-iiop-openjdk

https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat JBoss Enterprise Application Platform 7",
                    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
                    "packageName": "wildfly-iiop-openjdk",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:jboss_enterprise_application_platform:7"
                    ]
                }

wildfly-ejb3

https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat JBoss Enterprise Application Platform 8",
                    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
                    "packageName": "wildfly-ejb3",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:jboss_enterprise_application_platform:8"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON