A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.

Project Subscriptions

Vendors Products
Jboss Enterprise Application Platform Subscribe
Jboss Enterprise Application Platform Els Subscribe
Jboss Enterprise Application Platform Expansion Pack Subscribe
Jbosseapxp Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.


Workaround

To reduce the risk, enable the AUTH protocol in the JGroups protocol stack configuration of all clustered EAP instances so that only authenticated nodes can join the cluster, and restrict network access to the JGroups cluster traffic (bind port range and multicast/TCP discovery addresses) so that only trusted hosts can reach it. These measures prevent untrusted network-adjacent hosts from joining the cluster and injecting crafted serialized session data. The complete remediation is to install the updated packages as they become available through the product's update channels.

History

Sun, 01 Nov 2026 01:30:00 +0000


Sun, 01 Nov 2026 00:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9

Fri, 30 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7

Tue, 20 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7

Fri, 09 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:8

Fri, 25 Sep 2026 13:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:7.4

Tue, 22 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
References

Thu, 17 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
References

Thu, 17 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
References

Mon, 24 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7

Wed, 12 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
References

Tue, 11 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Els
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
Vendors & Products Redhat jboss Enterprise Application Platform Els
References

Tue, 11 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Tue, 11 Aug 2026 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Expansion Pack
Vendors & Products Redhat jboss Enterprise Application Platform Expansion Pack

Tue, 11 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

threat_severity

Important


Tue, 11 Aug 2026 09:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.
Title Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller
First Time appeared Redhat
Redhat jboss Enterprise Application Platform
Redhat jbosseapxp
Weaknesses CWE-502
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:jbosseapxp
Vendors & Products Redhat
Redhat jboss Enterprise Application Platform
Redhat jbosseapxp
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}


Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-11-01T00:11:32.415Z

Reserved: 2026-07-13T04:57:54.377Z

Link: CVE-2026-15555

cve-icon Vulnrichment

Updated: 2026-08-11T16:52:44.976Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-11T09:17:12.540

Modified: 2026-11-01T01:17:21.123

Link: CVE-2026-15555

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-11T05:49:54Z

Links: CVE-2026-15555 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T14:00:14Z

Weaknesses