CVE-2026-15563

Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos

Published Aug 11, 2026 CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Description
A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
Type Values Removed Values Added
CPEs cpe:/a:redhat:red_hat_single_sign_on:7.6::el7
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:red_hat_single_sign_on:7.6::el8
cpe:/a:redhat:red_hat_single_sign_on:7.6::el9
References
Type Values Removed Values Added
First Time appeared Redhat rhosemc
CPEs cpe:/a:redhat:red_hat_single_sign_on:7 cpe:/a:redhat:red_hat_single_sign_on:7.6
cpe:/a:redhat:rhosemc:1.0::el8
Vendors & Products Redhat rhosemc
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:7.4
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
References
Type Values Removed Values Added
First Time appeared Redhat jboss Fuse
Redhat red Hat Single Sign On
CPEs cpe:/a:redhat:jboss_fuse:7
cpe:/a:redhat:red_hat_single_sign_on:7
Vendors & Products Redhat jboss Fuse
Redhat red Hat Single Sign On
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
References
Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Els
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
Vendors & Products Redhat jboss Enterprise Application Platform Els
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Expansion Pack
Vendors & Products Redhat jboss Enterprise Application Platform Expansion Pack
Type Values Removed Values Added
Description A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.
Title Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos
First Time appeared Redhat
Redhat jboss Enterprise Application Platform
Redhat jbosseapxp
Weaknesses CWE-306
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:jbosseapxp
Vendors & Products Redhat
Redhat jboss Enterprise Application Platform
Redhat jbosseapxp
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}