CVE-2015-7501: Deserialization of Untrusted Data in Apache commons collections

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 85.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-11-09 · updated 2026-06-17
Weakness: CWE-502

Description

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Affected products

RedHat Data Grid: 6.0.0
RedHat Jboss A-Mq: 6.0.0
RedHat Jboss Bpm Suite: 6.0.0
RedHat Jboss Data Virtualization: 5.0.0, 6.0.0
Red Hat JBoss EAP: 4.3.0, 5.0.0, 6.0.0
RedHat Jboss Enterprise Brms Platform: 5.0.0, 6.0.0
RedHat Jboss Enterprise Soa Platform: 5.0.0
Red Hat JBoss Enterprise Web Server: 3.0.0
RedHat Jboss Fuse: 6.0.0
RedHat Jboss Fuse Service Works: 6.0
Red Hat JBoss: 3.0
Red Hat JBoss Portal: 6.0.0
Openshift: 3.0
RedHat Subscription Asset Manager: 1.3.0
RedHat Xpaas: 3.0.0
Maven Commons-Collections:Commons-Collections: before 3.2.2; 1.0, 2.0, 2.0.20020914.015953, 2.0.20020914.020746, 2.0.20020914.020858, 2.1 (+6) — fixed in 3.2.2
Maven Net.Sourceforge.Collections:Collections-Generic: 4.01
Maven Org.Apache.Commons:Commons-Collections4: before 4.1; 4.0 — fixed in 4.1
Maven Org.Apache.Servicemix.Bundles:Org.Apache.Servicemix.Bundles.Collections-Generic: from 4.01; 4.01_1
Maven Org.Apache.Servicemix.Bundles:Org.Apache.Servicemix.Bundles.Commons-Collections: from 3.2.1; 3.2.1_1, 3.2.1_2, 3.2.1_3

How to fix

Upgrade to a fixed version: Maven Commons-Collections:Commons-Collections 3.2.2; Maven Org.Apache.Commons:Commons-Collections4 4.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2015-7501 or the next vulnerability affects your stack