Authentication Bypass in Wildfly Affects Remote EJB Invocation
CVE-2026-114488

7.4HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Fuse 7
Red Hat Jboss Enterprise Application Platform 7
Red Hat Jboss Enterprise Application Platform 8
Red Hat Jboss Enterprise Application Platform Expansion Pack
Vendor
CVE Published:
29 October 2026

What is CVE-2026-114488?

A flaw in Wildfly enables remote attackers to bypass authentication on IIOP EJB invocations. The issue arises because the CSIv2 security interceptor accepts ITTPrincipalName identity assertions within the service context without verifying transport-level authentication. This deficiency allows attackers to impersonate any principal over port 3528, exposing @Remote EJB services to unauthorized access. It's crucial for organizations using affected versions of Wildfly to address this vulnerability to secure their applications.

References

https://access.redhat.com/security/cve/CVE-2026-114488
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2491619
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.