Remote Code Execution Vulnerability in JBoss Product by Red Hat
CVE-2026-15555

8.8HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Jboss Enterprise Application Platform 7
Red Hat Jboss Enterprise Application Platform 8
Red Hat Jboss Enterprise Application Platform Expansion Pack
Vendor
CVE Published:
11 August 2026

What is CVE-2026-15555?

A flaw in JBoss marshalling affects the Infinispan session replication mechanism, where session data is deserialized without proper class filtering. This oversight allows for the execution of remote code through deserialization gadget chains, potentially compromising every node within a JBoss cluster.

References

https://access.redhat.com/security/cve/CVE-2026-15555
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2480637
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.