CVE-2026-15555

Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller

Published Aug 11, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.

Remediation

Vendor Workaround

To reduce the risk, enable the AUTH protocol in the JGroups protocol stack configuration of all clustered EAP instances so that only authenticated nodes can join the cluster, and restrict network access to the JGroups cluster traffic (bind port range and multicast/TCP discovery addresses) so that only trusted hosts can reach it. These measures prevent untrusted network-adjacent hosts from joining the cluster and injecting crafted serialized session data. The complete remediation is to install the updated packages as they become available through the product's update channels.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:8
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:7.4
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
References
Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Els
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
Vendors & Products Redhat jboss Enterprise Application Platform Els
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Expansion Pack
Vendors & Products Redhat jboss Enterprise Application Platform Expansion Pack
Type Values Removed Values Added
Description A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.
Title Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller
First Time appeared Redhat
Redhat jboss Enterprise Application Platform
Redhat jbosseapxp
Weaknesses CWE-502
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:jbosseapxp
Vendors & Products Redhat
Redhat jboss Enterprise Application Platform
Redhat jbosseapxp
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 1, 2026, 12:11 AM
Reserved
Jul 13, 2026, 4:57 AM
Status
Awaiting Analysis
Published
Aug 11, 2026, 9:17 AM
Modified
Nov 1, 2026, 1:17 AM
Severity
Important
Public date
Aug 11, 2026, 5:49 AM