Vulnerability · Published Aug 11, 2026 · Assigned by redhat
CVE-2026-15555Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller
High 8.8
In plain English
A high-severity unsafe deserialization in Red Hat JBoss Enterprise Application Platform 7.4.25 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.8%top 42.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.
Affected products (as reported)
Weakness: CWE-502 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- RHSA-2026:53644 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:53806 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70228 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70229 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70230 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70277 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-15555 vdb-entry, x_refsource_REDHAT
- RHBZ#2480637 issue-tracking, x_refsource_REDHAT