CVE-2026-15564

Published: Oct 29, 2026Modified: Oct 29, 2026

7.4

Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.4 / Impact: 5.9

Source: secalert@redhat.com

Description

Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and depending on the potential gadget chains available in the running classpath.

Related CWEs

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

References (2)

https://access.redhat.com/security/cve/CVE-2026-15564

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2478005

Source: secalert@redhat.com

Timeline

No history available yet.