Deserialization Vulnerability in Wildfly's IIOP Listener Impacting Red Hat
CVE-2026-15564

7.4HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Jboss Enterprise Application Platform 7
Red Hat Jboss Enterprise Application Platform 8
Vendor
CVE Published:
29 October 2026

What is CVE-2026-15564?

A vulnerability exists in Wildfly's IIOP listener that could allow unauthorized deserialization of input streams prior to having authenticated access. This flaw arises when an attacker with access to the IIOP port can send maliciously crafted objects to the server, potentially exploiting untyped method parameters in the target Enterprise JavaBeans (EJB) if certain conditions regarding the available gadget chains in the runtime classpath are met.

References

https://access.redhat.com/security/cve/CVE-2026-15564
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2478005
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.