Red Hat JBoss Enterprise Application Platform 7.4.25 vulnerabilities

12 CVEs affecting Red Hat JBoss Enterprise Application Platform 7.4.25, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-101292, published 2026-09-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-86404, published 2026-09-07. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via…
CVE-2026-15565, published 2026-08-11. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an…
CVE-2026-15560, published 2026-08-11. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate…
CVE-2026-15567, published 2026-08-11. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and…
CVE-2026-15562, published 2026-08-11. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that…
CVE-2026-15561, published 2026-08-11. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory…
CVE-2026-101292, published 2026-09-28. High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days. Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls…
CVE-2026-15563, published 2026-08-11. High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB,…
CVE-2026-15554, published 2026-08-11. High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days. the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port…
CVE-2026-10579, published 2026-08-11. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as…

Latest

CVE-2026-15556, published 2026-08-11. High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as…
CVE-2026-15555, published 2026-08-11. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE…