CVE-2015-7501: Red Hat Data Grid

Critical severity, CVSS 9.8. EPSS: 85.6% chance of exploitation in the next 30 days.

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Affected products

• Red Hat Data Grid: version 6.0.0 only
• Red Hat JBoss A-Mq: version 6.0.0 only
• Red Hat JBoss Bpm Suite: version 6.0.0 only
• Red Hat JBoss Data Virtualization: version 5.0.0 only; version 6.0.0 only
• Red Hat JBoss Enterprise Application Platform: version 4.3.0 only; version 5.0.0 only; version 6.0.0 only
• Red Hat JBoss Enterprise Brms Platform: version 5.0.0 only; version 6.0.0 only
• Red Hat JBoss Enterprise Soa Platform: version 5.0.0 only
• Red Hat JBoss Enterprise Web Server: version 3.0.0 only
• Red Hat JBoss Fuse: version 6.0.0 only
• Red Hat JBoss Fuse Service Works: version 6.0 only
• Red Hat JBoss Operations Network: version 3.0 only
• Red Hat JBoss Portal: version 6.0.0 only
• Red Hat Openshift: version 3.0 only
• Red Hat Subscription Asset Manager: version 1.3.0 only
• Red Hat Xpaas: version 3.0.0 only

Published 2017-11-09. Last modified 2026-06-17.