Remote Code Execution Vulnerability in WildFly Core by Red Hat
CVE-2026-24330
6.5MEDIUM
What is CVE-2026-24330?
An identified flaw in WildFly Core allows an authenticated remote attacker with a 'deployer' account to import and deploy malicious archive files from untrusted sources. This exploit leverages WildFly libraries to craft a Java project, facilitating the submission of an HTTP POST request that uploads and executes the harmful archive. This vulnerability raises significant concerns as it could result in further exploitation scenarios, including arbitrary file read issues.
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank Claudia Bartolini (TIM Security Red Team Research - TIM S.p.A), Marco Ventura (TIM Security Red Team Research - TIM S.p.A), and Massimiliano Brolli (TIM Security Red Team Research - TIM S.p.A) for reporting this issue.