Vulnerability · Published Aug 11, 2026 · Assigned by redhat
CVE-2026-15563Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos
High 7.4
In plain English
A high-severity missing authentication in Red Hat JBoss Enterprise Application Platform 7.4.25 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.7%top 48.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.
Affected products (as reported)
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- RHSA-2026:53644 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:53806 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70228 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70229 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70230 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70277 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:76128 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:76129 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:76130 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:76132 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:76134 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-15563 vdb-entry, x_refsource_REDHAT
- RHBZ#2483138 issue-tracking, x_refsource_REDHAT