Red Hat JBoss Enterprise Application Platform 8.1 vulnerabilities

12 CVEs affecting Red Hat JBoss Enterprise Application Platform 8.1, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-10832, published 2026-09-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-27830, published 2026-02-26. High severity, CVSS 8.0. EPSS: 2% chance of exploitation in the next 30 days. c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource`…
CVE-2026-5680, published 2026-08-27. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive…
CVE-2026-86404, published 2026-09-07. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via…
CVE-2026-15565, published 2026-08-11. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an…
CVE-2026-15560, published 2026-08-11. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate…
CVE-2026-15567, published 2026-08-11. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and…
CVE-2026-15562, published 2026-08-11. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that…
CVE-2026-15561, published 2026-08-11. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory…
CVE-2026-10832, published 2026-09-18. Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER (Distinguished Encoding…
CVE-2026-15563, published 2026-08-11. High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB,…

Latest

CVE-2026-15555, published 2026-08-11. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE…