CVE-2015-7450

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www-01.ibm.com/support/docview.wss?uid=swg21970575Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21971342Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21971376Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21971733Broken Link
http://www-01.ibm.com/support/docview.wss?uid=swg21971758Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21972799Vendor Advisory
http://www.securityfocus.com/bid/77653Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035125Broken Link, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/41613/Exploit, Third Party Advisory, VDB Entry
http://www-01.ibm.com/support/docview.wss?uid=swg21970575Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21971342Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21971376Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21971733Broken Link
http://www-01.ibm.com/support/docview.wss?uid=swg21971758Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21972799Vendor Advisory
http://www.securityfocus.com/bid/77653Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035125Broken Link, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/41613/Exploit, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-7450US Government Resource

Timeline

Published: Jan 2, 2016
Last modified: Jun 17, 2026
Added to CISA KEV: Jan 10, 2022
NVD status: Analyzed

Related CVEs from 2015

CVE-2015-74515.4Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5 before 7.5.0.9 IF2 and 7.6 before 7.6.0.3 FP3 and Maximo Asset M CVE-2015-74524.3IBM Maximo Asset Management 7.5 before 7.5.0.9 FP9 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 FP9, 7.5.1, and CVE-2015-74536.1Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management (CLM) 3.0.1 before 3.0.1.6 iFix7 Interim Fix 1, CVE-2015-74544.3Business Space in IBM WebSphere Process Server 6.1.2.0 through 7.0.0.5 and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x th CVE-2015-74553.1IBM WebSphere Portal 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 uses weak permissions for content it CVE-2015-74566.5IBM Spectrum Scale 4.1.1 before 4.1.1.4, and 4.2.0.0, allows remote authenticated users to discover object-storage admin passwords via unspe CVE-2015-74576.1Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 allows remote attac CVE-2015-74585.4Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inj CVE-2015-74595.4Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inj CVE-2015-74605.4Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inj CVE-2015-74616.5XML external entity (XXE) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote authenticated use CVE-2015-74624.4IBM WebSphere MQ 8.0.0.4 on IBM i platforms allows local users to discover cleartext certificate-keystore passwords within MQ trace output b