Vulnerability · Published Aug 11, 2026 · Assigned by redhat
CVE-2026-15554Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery
High 7.4
In plain English
A high-severity improper certificate validation in Red Hat JBoss Enterprise Application Platform 7.4.25 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.5%top 58.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | undertow | no fix listed | DEBIAN-CVE-2026-15554 |
| Ubuntu:26.04:LTS | undertow | no fix listed | UBUNTU-CVE-2026-15554 |
| Ubuntu:26.10 | undertow | no fix listed | UBUNTU-CVE-2026-15554 |
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- RHSA-2026:53644 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:53806 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70228 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70229 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70230 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70277 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-15554 vdb-entry, x_refsource_REDHAT
- RHBZ#2480601 issue-tracking, x_refsource_REDHAT