---
id: "CVE-2017-12149"
kind: "vulnerability"
aliases: ["CVE-2017-12149"]
title: "Red Hat JBoss Application Server: Red Hat JBoss Application Server Remote Code Execution Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.90713
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Red Hat JBoss Application Server", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "java", "jboss", "ransomware", "red-hat-eap", "runtime"]
not_affected_if: ["not-deserialization-endpoint-exposed", "not-eap-5.2"]
published_at: "2017-10-04T21:01:00+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12149", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-12149", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12149", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Red Hat JBoss Application Server: Red Hat JBoss Application Server Remote Code Execution Vulnerability

JBoss Application Server shipped with Red Hat Enterprise Application Platform 5.2 deserializes crafted serialized data without checks. An unauthenticated attacker who sends such data can execute arbitrary code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Red Hat JBoss Application Server affected ? fixed ?

## Fix

Apply the Red Hat update for JBoss Application Server per vendor instructions (CISA required action); the specific patched version is unknown from the sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12149
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2017-12149
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2017-12149

## From the sources

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_