8.8

CVE-2026-15555

Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4.25
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.16.0-22.redhat_00057.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.3.14-11.SP11_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:1.5.26-2.Final_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:5.0.31-3.SP2_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:1.10.0-46.Final_redhat_00044.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:4.1.135-1.Final_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:4.1.135-1.Final_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.5.5-30.SP12_redhat_00020.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.5.5-24.SP12_redhat_00016.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.2.40-2.SP3_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:7.4.25-2.GA_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 8
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 8
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform Expansion Pack
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform Expansion Pack
Default Statusaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.26% 0.182
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 8.8 2.8 5.9
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://access.redhat.com/security/cve/CVE-2026-15555
https://bugzilla.redhat.com/show_bug.cgi?id=2480637
https://access.redhat.com/errata/RHSA-2026:53644
https://access.redhat.com/errata/RHSA-2026:53806