Red Hat JBoss EAP: Pre-authentication deserialization in IIOP listener
Summary
The IIOP listener of Red Hat JBoss Enterprise Application Platform (EAP), based on WildFly, may deserialize input streams before authentication is performed. An attacker who can reach the IIOP port may send crafted serialized objects and achieve code execution if an exposed EJB accepts untyped method parameters and suitable gadget chains exist on the classpath. Red Hat rates the issue as Moderate because standard deployments bind IIOP to localhost by default.
Affected
- Red Hat JBoss Enterprise Application Platform 7 (default: affected, per CNA record; other sources list all versions)
- Red Hat JBoss Enterprise Application Platform 8 (default: affected)
- Affected versions and ranges: Unknown.
Fixed in
Unknown. No fixed version was found in the sources reviewed. Check the Red Hat advisory and errata for your EAP stream.
Workaround
- Restrict network access to the IIOP listener (default TCP port 3528) so that only localhost or authorized management networks can reach it.
- Example: firewall-cmd --permanent --remove-port=3528/tcp and firewall-cmd --reload
- If CORBA/IIOP is not required, remove the IIOP subsystem: jboss-cli.sh --connect --command="/subsystem=iiop-openjdk:remove"
- Caveat: removing the IIOP subsystem breaks remote EJB invocations and CORBA/IIOP services. Firewall changes and subsystem removal disrupt active connections and require a reload or restart.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No known exploitation found; not listed as KEV in the sources reviewed.
- No public proof of concept found.
- EPSS: 0.12 % (percentile 2).
Our recommendation
- Check whether EAP or WildFly servers run the IIOP subsystem and whether it is needed.
- Confirm that TCP 3528 is not reachable from the internet or untrusted networks.
- If IIOP is not needed, remove the subsystem.
- If IIOP is needed, obtain the fix from Red Hat once confirmed for your EAP stream and apply it.
- Review the related IIOP and pre-authentication errata, such as RHSA-2026:70277, at the same time.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE page CVE-2026-15564 access.redhat.com
- Red Hat Bugzilla 2478005 (access denied) bugzilla.redhat.com
- Red Hat errata RHSA-2026:70277 access.redhat.com
- Strix CVE-2026-15564 www.strix.ai
- VulDB CVE-2026-15564 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 00:23.
Original description (NVD)
Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and depending on the potential gadget chains available in the running classpath.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.