What’s Vulnerable › Vulnerabilities

CVE-2025-23368: Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-03-04 · updated 2026-10-19
• Weakness: CWE-307

Description

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.

Affected products

• RedHat Data Grid: 8.0
• Red Hat JBoss EAP: 7.0.0, 8.0.0
• RedHat Wildfly Core: before 31.0.3 — fixed in 31.0.3

How to fix

Upgrade to a fixed version: RedHat Wildfly Core 31.0.3. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:18054
• https://access.redhat.com/errata/RHSA-2026:18055
• https://access.redhat.com/errata/RHSA-2026:18059
• https://access.redhat.com/errata/RHSA-2026:33371
• https://access.redhat.com/security/cve/CVE-2025-23368
• https://bugzilla.redhat.com/show_bug.cgi?id=2337621
• https://www.gruppotim.it/it/footer/red-team.html

Get alerted when CVE-2025-23368 or the next vulnerability affects your stack