Live › vulnerability › CVE-2026-114488
WildFly's CSIv2 security interceptor trusts identity assertions (ITTPrincipalName) in IIOP service context without checking transport authentication. A remote attacker on port 3528 can impersonate any principal on IIOP-exposed @Remote EJBs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
WildFly or JBoss EAP servers with the iiop-openjdk subsystem enabled and caller propagation turned on (non-default), exposing @Remote EJBs over IIOP (port 3528) without client mutual TLS or mandatory authentication. Default configurations (caller-propagation=none) are not exposed per Red Hat. Teams not using IIOP or keeping 3528 firewalled can skip it. Affected and fixed versions are not published yet.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to impersonate any principal on every IIOP-exposed @Remote EJB.
This page as .md · .json · in your agent: get_signal("CVE-2026-114488")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.