Red Hat WildFly/JBoss EAP: Authentication bypass in IIOP EJB invocations

Summary

A flaw in the IIOP/CSIv2 security interceptor of WildFly and Red Hat JBoss Enterprise Application Platform lets a remote attacker bypass authentication on IIOP EJB invocations. The interceptor accepts identity assertions (ITTPrincipalName) in the service context without verifying transport-level authentication. An unauthenticated attacker reaching port 3528 could impersonate any principal on IIOP-exposed remote EJBs. Red Hat states that the vulnerability only applies when caller propagation is enabled without mutual TLS or mandatory authentication.

Affected

• Red Hat Fuse 7
• Red Hat JBoss Enterprise Application Platform 7
• Red Hat JBoss Enterprise Application Platform 8 (default: affected)
• Red Hat Single Sign-On 7
• Red Hat JBoss Enterprise Application Platform Expansion Pack: unaffected (per Red Hat)
• Exact affected versions: Unknown.

Fixed in

Unknown. No fixed build confirmed in the sources; check the Red Hat CVE page and errata.

Workaround

• Set the IIOP subsystem caller-propagation to 'none': /subsystem=iiop-openjdk:write-attribute(name=caller-propagation,value=none)
• Ensure deployment descriptors (such as jboss-ejb3.xml) do not override caller propagation to 'supported'.
• Block external access to TCP port 3528 or restrict it to trusted networks.
• If caller propagation is required, require SSL/TLS with client certificate authentication (server-requires-ssl="true") or enforce mandatory authentication via as-context.
• Caveat: disabling caller propagation may affect applications relying on distributed identity propagation; a runtime reload interrupts active connections.

Exploitation

• Not known to be exploited in the wild; not listed in CISA KEV.
• No public proof-of-concept found at the time of research.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS: 0.34 % (low).

Our recommendation

• Identify all WildFly, EAP, Fuse and SSO hosts with IIOP enabled (port 3528) and check the caller-propagation setting.
• Set caller propagation to 'none' or enforce mutual TLS, and block port 3528 from untrusted networks.
• Check whether port 3528 is reachable from the internet.
• Patch as soon as Red Hat publishes fixed builds, then verify.
• Patch and restrict the whole IIOP listener, as related IIOP CVEs (such as CVE-2026-15563 and CVE-2026-15564) were published at the same time.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Red Hat CVE page CVE-2026-114488 access.redhat.com
• Red Hat Security Data API (CVE) access.redhat.com
• VulDB CVE-2026-114488 vuldb.com
• OffSeq radar: WildFly IIOP authentication bypass radar.offseq.com
• Strix CVE-2026-114488 www.strix.ai
• Red Hat errata RHSA-2026:70277 access.redhat.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 00:23.