7.4

CVE-2026-15563

Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4.25
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.16.0-22.redhat_00057.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.3.14-11.SP11_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:1.5.26-2.Final_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:5.0.31-3.SP2_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:1.10.0-46.Final_redhat_00044.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:4.1.135-1.Final_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:4.1.135-1.Final_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.5.5-30.SP12_redhat_00020.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.5.5-24.SP12_redhat_00016.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.2.40-2.SP3_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:7.4.25-2.GA_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 8
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform Expansion Pack
Default Statusunaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.29% 0.214
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 7.4 2.2 5.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://access.redhat.com/security/cve/CVE-2026-15563
https://bugzilla.redhat.com/show_bug.cgi?id=2483138
https://access.redhat.com/errata/RHSA-2026:53644
https://access.redhat.com/errata/RHSA-2026:53806