What’s Vulnerable › Vulnerabilities

CVE-2026-15564: Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-29 · updated 2026-10-29
• Weakness: CWE-829

Description

Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and depending on the potential gadget chains available in the running classpath.

Affected products

• Red Hat JBoss Enterprise Application Platform 7: all versions
• Red Hat JBoss Enterprise Application Platform 8: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-15564
• https://bugzilla.redhat.com/show_bug.cgi?id=2478005

Get alerted when CVE-2026-15564 or the next vulnerability affects your stack