High severity · published Oct 29, 2026
CVE-2026-15564
Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization
New
7.4
CVSS
–
EPSS
No
On KEV
Description
Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and depending on the potential gadget chains available in the running classpath.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat JBoss Enterprise Application Platform 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform 8 · Red Hat
All versions, or not specified · source: vendor
Affected product
RH
Red Hat JBoss Enterprise Application Platform 7
Red Hat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-15564
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-15564
vdb-entry
https://access.redhat.com/security/cve/CVE-2026-15564
issue-tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2478005
More from Red Hat JBoss Enterprise Application Platform 7
9.8
CVE-2026-10579
Picketlink-federation: auth bypass in picketlink saml unsolicited-response
9.8
CVE-2026-49875
Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
9.8
CVE-2026-27727
mchange-commons-java: Remote Code Execution via JNDI Reference Resolution
9.6
CVE-2025-12543
Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf
9.1
CVE-2026-28369
Undertow: undertow: request smuggling via malformed http request headers