Project Subscriptions
No advisories yet.
Solution
No solution given by the vendor.
Workaround
To reduce the risk, enable the AUTH protocol in the JGroups protocol stack configuration of all clustered EAP instances so that only authenticated nodes can join the cluster, and restrict network access to the JGroups cluster traffic (bind port range and multicast/TCP discovery addresses) so that only trusted hosts can reach it. These measures prevent untrusted network-adjacent hosts from joining the cluster and injecting crafted serialized session data. The complete remediation is to install the updated packages as they become available through the product's update channels.
Sun, 01 Nov 2026 01:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Sun, 01 Nov 2026 00:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9 |
Fri, 30 Oct 2026 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform:7 |
Tue, 20 Oct 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs |
Fri, 09 Oct 2026 03:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform:8 |
Fri, 25 Sep 2026 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:7.4 |
Tue, 22 Sep 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 |
|
| References |
|
Thu, 17 Sep 2026 23:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9 | |
| References |
|
Thu, 17 Sep 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7 |
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8 |
| References |
|
Mon, 24 Aug 2026 11:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform:7 |
Wed, 12 Aug 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7 | |
| References |
|
Tue, 11 Aug 2026 20:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat jboss Enterprise Application Platform Els
|
|
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 | |
| Vendors & Products |
Redhat jboss Enterprise Application Platform Els
|
|
| References |
|
Tue, 11 Aug 2026 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 11 Aug 2026 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat jboss Enterprise Application Platform Expansion Pack
|
|
| Vendors & Products |
Redhat jboss Enterprise Application Platform Expansion Pack
|
Tue, 11 Aug 2026 12:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Tue, 11 Aug 2026 09:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node. | |
| Title | Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller | |
| First Time appeared |
Redhat
Redhat jboss Enterprise Application Platform Redhat jbosseapxp |
|
| Weaknesses | CWE-502 | |
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jbosseapxp |
|
| Vendors & Products |
Redhat
Redhat jboss Enterprise Application Platform Redhat jbosseapxp |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-11-01T00:11:32.415Z
Reserved: 2026-07-13T04:57:54.377Z
Link: CVE-2026-15555
Updated: 2026-08-11T16:52:44.976Z
Status : Awaiting Analysis
Published: 2026-08-11T09:17:12.540
Modified: 2026-11-01T01:17:21.123
Link: CVE-2026-15555
OpenCVE Enrichment
Updated: 2026-08-11T14:00:14Z