What’s Vulnerable › Vulnerabilities

CVE-2026-15563: Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-11-01
• Weakness: CWE-306

Description

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.

Affected products

• Red Hat JBoss Enterprise Application Platform 7: all versions
• Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7: all versions — fixed in 0:2.16.0-22.redhat_00057.1.el7eap
• Red Hat JBoss Enterprise Application Platform 8.1.8.GA: all versions — fixed in 8.1.1.GA-redhat-00048
• Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10: all versions — fixed in 0:2.40.0-8.redhat_00024.1.el10eap
• Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8: all versions — fixed in 0:2.40.0-8.redhat_00024.1.el8eap
• Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9: all versions — fixed in 0:2.40.0-8.redhat_00024.1.el9eap
• Red Hat Single Sign-On 7.6 for RHEL 7: all versions — fixed in 0:18.0.20-1.redhat_00001.1.el7sso
• Red Hat Single Sign-On 7.6 for RHEL 8: all versions — fixed in 0:18.0.20-1.redhat_00001.1.el8sso
• Red Hat Single Sign-On 7.6 for RHEL 9: all versions — fixed in 0:18.0.20-1.redhat_00001.1.el9sso
• Red Hat RHEL-8 based Middleware Containers: all versions — fixed in 7.6-85

How to fix

Upgrade to a fixed version: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:2.16.0-22.redhat_00057.1.el7eap; Red Hat JBoss Enterprise Application Platform 8.1.8.GA 8.1.1.GA-redhat-00048; Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 0:2.40.0-8.redhat_00024.1.el10eap; Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 0:2.40.0-8.redhat_00024.1.el8eap; Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 0:2.40.0-8.redhat_00024.1.el9eap; Red Hat Single Sign-On 7.6 for RHEL 7 0:18.0.20-1.redhat_00001.1.el7sso; Red Hat Single Sign-On 7.6 for RHEL 8 0:18.0.20-1.redhat_00001.1.el8sso; Red Hat Single Sign-On 7.6 for RHEL 9 0:18.0.20-1.redhat_00001.1.el9sso; Red Hat RHEL-8 based Middleware Containers 7.6-85. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:53644
• https://access.redhat.com/errata/RHSA-2026:53806
• https://access.redhat.com/errata/RHSA-2026:70228
• https://access.redhat.com/errata/RHSA-2026:70229
• https://access.redhat.com/errata/RHSA-2026:70230
• https://access.redhat.com/errata/RHSA-2026:70277
• https://access.redhat.com/errata/RHSA-2026:76128
• https://access.redhat.com/errata/RHSA-2026:76129
• https://access.redhat.com/errata/RHSA-2026:76130
• https://access.redhat.com/errata/RHSA-2026:76132
• https://access.redhat.com/errata/RHSA-2026:76134
• https://access.redhat.com/security/cve/CVE-2026-15563

Get alerted when CVE-2026-15563 or the next vulnerability affects your stack