Security Advisory catalog CVE-2026-19610
cve-program · CVE-2026-19610 Published
A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for the read-resource operation on the runtime management resource fails to perform required Role-Based Access Control (RBAC) checks. This allows an authenticated user with low-privileged access, such as the Monitor role, to view sensitive system properties and JVM configuration details that should be restricted.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-19610 Published wildfly-platform-mbean https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.1",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected",
"packageName": "wildfly-platform-mbean",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1"
]
} eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8 https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"packageName": "eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
]
} eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8 https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"packageName": "eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
]
} eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8 https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"packageName": "eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
]
} jboss-eap-7-eap74-els-openjdk17-openshift-rhel8/jboss-eap-7-eap74-els-openjdk17-openshift-rhel8 https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"packageName": "jboss-eap-7-eap74-els-openjdk17-openshift-rhel8/jboss-eap-7-eap74-els-openjdk17-openshift-rhel8",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
]
} jboss-eap-7-eap74-els-openjdk8-openshift-rhel8/jboss-eap-7-eap74-els-openjdk8-openshift-rhel8 https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"packageName": "jboss-eap-7-eap74-els-openjdk8-openshift-rhel8/jboss-eap-7-eap74-els-openjdk8-openshift-rhel8",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
]
} wildfly-platform-mbean https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"packageName": "wildfly-platform-mbean",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
]
} wildfly-platform-mbean https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"packageName": "wildfly-platform-mbean",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
]
} wildfly-platform-mbean https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Single Sign-On 7",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "wildfly-platform-mbean",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
]
} Original source record · Cite this exact observation · Complete original publisher JSON