Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.new Create a CVE report
Check your stack
CVE-2026-15564high7.4

Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization

Impact

Wildfly's IIOP listener may permit deserialization of input streams before authentication, potentially allowing an attacker with access to the IIOP port to send malicious objects. The vulnerability affects Red Hat JBoss Enterprise Application Platform 7 and 8. The impact depends on the target EJB and available gadget chains.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.

What to do

Restrict network reachability to the IIOP listener (default TCP port 3528) so that only localhost or authorized management networks can access it.

  1. Restrict port exposure using firewalld:
firewall-cmd --permanent --remove-port=3528/tcp
firewall-cmd --reload
  1. If CORBA/IIOP interoperability is not required by deployed applications, remove the IIOP subsystem using the JBoss Management CLI:
jboss-cli.sh --connect --command="/subsystem=iiop-openjdk:remove"

Caveats: Removing the IIOP subsystem will break remote EJB invocations or external services that rely on CORBA/IIOP protocols.

Warning: Applying firewall changes or removing server subsystems will disrupt active client connections and requires reloading the server configuration or restarting the JBoss EAP service to take full effect.

redhat guidance

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

Red Hat · redhat

Red Hat JBoss Enterprise Application Platform 7

0 ranges
redhat version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

unaffected

unknown

Other versions: affected

Product identifiers (CPE)cpe:/a:redhat:jboss_enterprise_application_platform:7

Red Hat · redhat

Red Hat JBoss Enterprise Application Platform 7

0 ranges
redhat version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

unaffected

unknown

Other versions: unaffected

Product identifiers (CPE)cpe:/a:redhat:jboss_enterprise_application_platform:7

Red Hat · redhat

Red Hat JBoss Enterprise Application Platform 8

0 ranges
redhat version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

unaffected

unknown

Other versions: affected

Product identifiers (CPE)cpe:/a:redhat:jboss_enterprise_application_platform:8

Red Hat · redhat

Red Hat JBoss Enterprise Application Platform 8

0 ranges
redhat version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

unaffected

unknown

Other versions: affected

Product identifiers (CPE)cpe:/a:redhat:jboss_enterprise_application_platform:8

Original source description

Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and depending on the potential gadget chains available in the running classpath.

Inside the record

Evidence available

Package identity · not supplied
Version evidence · not supplied
Remediation guidance
Weakness classification
Additional publishers

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-15564

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-829 ↗

Inclusion of Functionality from Untrusted Control Sphere

redhat

Related →
Contributing organizations · 2
redhat

Assigning organization

2026-10-29
CISA-ADP

Additional data publisher

2026-10-29

What changed

Follow changes
  1. CVE · CVE-2026-15564

    Observed 2026-10-29T17:52:06.791Z · upstream updated 2026-10-29T17:20:33.597Z

    Prioritization updated

    before

    []

    after

    [
  {
    "source": "CISA-ADP",
    "type": "SSVC",
    "role": "CISA Coordinator",
    "timestamp": "2026-10-29T15:37:42.666505Z",
    "decisions": [
      {
        "name": "Exploitation",
        "value": "none"
      },
      {
        "name": "Automatable",
        "value": "no"
      },
      {
        "name": "Technical Impact",
        "value": "total"
      }
    ]
  }
]

Large field values are marked as truncated previews. Original source snapshots remain retained.

Showing up to 50 most recent observed changes.

References

2 sources
access.redhat.com/security/cve/CVE-2026-15564
vdb-entryredhat
bugzilla.redhat.com/show_bug.cgi
issue-trackingredhat