Vulnerability · Published Oct 29, 2026 · Assigned by redhat

CVE-2026-15564Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization

High 7.4

In plain English

A high-severity security flaw in Red Hat JBoss Enterprise Application Platform 7 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.1%top 97.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and depending on the potential gadget chains available in the running classpath.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat JBoss Enterprise Application Platform 7	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 7	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 8	see references

Weakness: CWE-829 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://access.redhat.com/security/cve/CVE-2026-15564 vdb-entry, x_refsource_REDHAT
RHBZ#2478005 issue-tracking, x_refsource_REDHAT