Remote Code Execution Vulnerability in JBoss Product by Red Hat
CVE-2026-15555

8.8HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Jboss Enterprise Application Platform 7.4.25
Red Hat Jboss Enterprise Application Platform 7.4 Els On Rhel 7
Red Hat Jboss Enterprise Application Platform 7
Red Hat Jboss Enterprise Application Platform 8
Vendor
CVE Published:
11 August 2026

What is CVE-2026-15555?

A flaw in JBoss marshalling affects the Infinispan session replication mechanism, where session data is deserialized without proper class filtering. This oversight allows for the execution of remote code through deserialization gadget chains, potentially compromising every node within a JBoss cluster.

Affected Version(s)

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:2.16.0-22.redhat_00057.1.el7eap

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:2.3.14-11.SP11_redhat_00001.1.el7eap

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:1.5.26-2.Final_redhat_00001.1.el7eap

References

https://access.redhat.com/errata/RHSA-2026:53644
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53806
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-15555
vdb-entryx_refsource_REDHAT

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.