Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7

• CVE-2026-101292 High 8.2 Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization 0.5%
• CVE-2026-15567 High 7.5 Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener 0.9%
• CVE-2026-15565 High 7.5 Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method 1.0%
• CVE-2026-15563 High 7.4 Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos 0.7%
• CVE-2026-15562 High 7.5 Jboss-remoting: jboss-remoting: integer overflow in messagereader leads to pre-authentication denial of service 0.9%
• CVE-2026-15561 High 7.5 Undertow-core: oom via missing limits in chunked trailer in eap's undertow 0.7%
• CVE-2026-15560 High 8.1 Openjdk-orb: unauthed class loading via iiop in eap 0.7%
• CVE-2026-15556 High 8.1 Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions 0.3%
• CVE-2026-15555 High 8.8 Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller 0.8%
• CVE-2026-15554 High 7.4 Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery 0.5%
• CVE-2026-10579 Critical 9.8 Picketlink-federation: auth bypass in picketlink saml unsolicited-response 0.4%
• CVE-2026-0603 High 8.3 Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection 1.0%
• CVE-2025-12543 Critical 9.6 Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf 1.3%
• CVE-2024-3884 High 7.5 Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded 1.5%
• CVE-2025-9784 High 7.5 Undertow: undertow madeyoureset http/2 ddos vulnerability 2.3%