Red Hat Wildfly vulnerabilities

18 CVEs affecting Red Hat Wildfly, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-23367, published 2025-01-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-10740, published 2020-06-22. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB) due to lack of validation/filtering…
CVE-2018-10683, published 2018-05-09. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. An issue was discovered in WildFly 10.1.2.Final. In the case of a default installation without a security realm reference, an attacker can successfully access the server without authentication. NOTE:…
CVE-2020-25689, published 2020-11-02. Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days. A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able…
CVE-2019-3894, published 2019-05-03. High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days. It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run the thread as. These threads do not necessarily terminate if…
CVE-2020-10718, published 2020-09-16. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thread Context Classloader (TCCL). This setting is exposed as a…
CVE-2020-25640, published 2020-11-24. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.
CVE-2020-27822, published 2020-12-08. Medium severity, CVSS 5.9. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final. When an application uses the OpenTracing API's java-interceptors, there is a…
CVE-2018-14627, published 2018-09-04. Medium severity, CVSS 5.9. EPSS: 1.1% chance of exploitation in the next 30 days. The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required. Servers before this version that are configured with the following setting…
CVE-2019-14887, published 2020-03-16. Critical severity, CVSS 9.1. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from…
CVE-2021-3503, published 2022-04-18. Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality.

Latest

CVE-2025-23367, published 2025-01-30. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user…
CVE-2022-1278, published 2022-09-13. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
CVE-2021-3644, published 2022-08-26. Low severity, CVSS 3.3. EPSS: 1% chance of exploitation in the next 30 days. A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management…
CVE-2022-0866, published 2022-05-10. Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days. This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the…
CVE-2020-1719, published 2021-06-07. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data…
CVE-2020-14317, published 2021-06-02. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. It was found that the issue for security flaw CVE-2019-3805 appeared again in a further version of JBoss Enterprise Application Platform - Continuous Delivery (EAP-CD) introducing regression. An…
CVE-2021-3536, published 2021-05-20. Medium severity, CVSS 4.8. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This…