7.4

CVE-2026-15554

Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery

the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4.25
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.16.0-22.redhat_00057.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.3.14-11.SP11_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:1.5.26-2.Final_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:5.0.31-3.SP2_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:1.10.0-46.Final_redhat_00044.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:4.1.135-1.Final_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:4.1.135-1.Final_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.5.5-30.SP12_redhat_00020.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.5.5-24.SP12_redhat_00016.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.2.40-2.SP3_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:7.4.25-2.GA_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 8
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform Expansion Pack
Default Statusunaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.22% 0.129
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 7.4 2.2 5.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

https://access.redhat.com/security/cve/CVE-2026-15554
https://bugzilla.redhat.com/show_bug.cgi?id=2480601
https://access.redhat.com/errata/RHSA-2026:53644
https://access.redhat.com/errata/RHSA-2026:53806