CVE-2026-15555

HighCVSS 8.8/10Last modified Nov 1, 2026

Description

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Red HatRed Hat JBoss Enterprise Application Platform 7.4.25—
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7—
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7—
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7—
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7—
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7—
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7—
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7—
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7—
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7—
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7—
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7—
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7—
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7—
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7—
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7—
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7—
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7—
Red HatRed Hat JBoss Enterprise Application Platform 8.1.8.GA—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10—

References

Timeline

Published
Aug 11, 2026
Last modified
Nov 1, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-155568.1A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check caCVE-2026-155577.3A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInternalTaskSession/getAuthCVE-2026-155586.3A security vulnerability has been detected in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown fuCVE-2026-155596.3A vulnerability was detected in CodeAstro Simple Online Leave Management System 1.0. This affects an unknown part of the file /SimpleOnlineLCVE-2026-15566.5Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allowsCVE-2026-155608.1when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, alCVE-2026-155617.5A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unaCVE-2026-155627.5A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an UpgradeCVE-2026-155637.4A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijaCVE-2026-155647.4Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to tCVE-2026-155657.5A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpointCVE-2026-155677.5A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attack