CVE-2021-3717: Red Hat JBoss Enterprise Application Platform

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, and availability. This flaw affects wildfly-core versions prior to 17.0.

Affected products

• Red Hat JBoss Enterprise Application Platform: affected versions not specified; version 7.4 only; version 7.3 only
• Red Hat Single Sign-On: affected versions not specified
• Red Hat Wildfly Core: before 17.0 (fixed in 17.0)

Published 2022-05-24. Last modified 2026-06-17.