Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller (Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25)

CVE-2026-15555

HIGH 8.8

En bref

Source: NVD
EPSS: EPSS 0.95 % · centile 61 (2026-10-31)
État: PUBLISHED
Publiée: 2026-08-11 08:49 UTC
Mise à jour: 2026-11-01 00:11 UTC
Attribuée par: redhat
Statut NVD: Awaiting Analysis

Rechercher sur…

Description

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.

Faiblesses (CWE)

CWE-502 — Désérialisation de données non fiables

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 8.8	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	redhat
CVSS 3.1	HIGH 8.8	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · secalert@redhat.com (Secondary)

Références européennes

ENISA EUVD · EUVD-2026-55982
GCVE · GCVE-0-2026-15555

Produits affectés

Produit	Versions
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4.25
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	unaffected 0:2.16.0-22.redhat_00057.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	unaffected 0:2.3.14-11.SP11_redhat_00001.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	unaffected 0:1.5.26-2.Final_redhat_00001.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	unaffected 0:2.18.8-1.redhat_00003.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	unaffected 0:2.18.8-1.redhat_00003.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	unaffected 0:2.18.8-1.redhat_00003.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	unaffected 0:2.18.8-1.redhat_00003.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	unaffected 0:2.18.8-1.redhat_00003.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	unaffected 0:2.18.8-1.redhat_00003.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	unaffected 0:5.0.31-3.SP2_redhat_00001.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	unaffected 0:1.10.0-46.Final_redhat_00044.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	unaffected 0:4.1.135-1.Final_redhat_00001.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	unaffected 0:4.1.135-1.Final_redhat_00001.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	unaffected 0:2.5.5-30.SP12_redhat_00020.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	unaffected 0:2.5.5-24.SP12_redhat_00016.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	unaffected 0:2.2.40-2.SP3_redhat_00001.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	unaffected 0:7.4.25-2.GA_redhat_00001.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1.8.GA	unaffected 5.0.13.Final-redhat-00001 < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10	unaffected 0:2.40.0-8.redhat_00024.1.el10eap < *

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller (Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25)