{"id":"CVE-2026-114488","kind":"vulnerability","aliases":["CVE-2026-114488"],"related":[],"title":"WildFly: IIOP EJB calls accept forged identities, bypassing authentication","description":"A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to impersonate any principal on every IIOP-exposed @Remote EJB.","summary":"WildFly's CSIv2 security interceptor trusts identity assertions (ITTPrincipalName) in IIOP service context without checking transport authentication. A remote attacker on port 3528 can impersonate any principal on IIOP-exposed @Remote EJBs.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ejb","iiop","java","jboss-eap","runtime","self-hosted","wildfly"],"not_affected_if":["caller-propagation-none","iiop-disabled","mtls-required","no-remote-ejb","port-firewalled"],"how_to_check":"- Run /subsystem=iiop-openjdk:read-attribute(name=caller-propagation) in the management CLI; 'none' (the default) means the asserted-identity path is off, 'supported' means you are exposed\n- Check whether port 3528 (IIOP) is reachable from untrusted networks and whether server-requires-ssl / as-context is enforced\n- Check jboss-ejb3.xml for overrides setting caller propagation to 'supported'","fix":null,"status":"open","published_at":"2026-10-29T06:17:19+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","triaged_at":"2026-10-29T06:54:30+00:00","updated_at":"2026-10-29T06:56:06+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-29T06:54:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WildFly: IIOP EJB calls accept forged identities, bypassing authentication","impact":"high","summary":"WildFly's CSIv2 security interceptor trusts identity assertions (ITTPrincipalName) in IIOP service context without checking transport authentication. A remote attacker on port 3528 can impersonate any principal on IIOP-exposed @Remote EJBs.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wildfly","java","iiop","ejb"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker impersonates any user calling exposed remote EJBs","analyst_note":"Find affected and fixed WildFly versions and the IIOP configuration needed to be exposed in the NVD entry or the WildFly advisory.","how_to_check":"- Check whether IIOP is enabled in the WildFly configuration (the `iiop-openjdk` subsystem or ORB settings) and whether port `3528` is reachable from untrusted networks\n- Check the WildFly version in use with `unknown`; the sources do not list affected version ranges","plain_action":"","needs_analyst":true,"not_affected_if":["iiop-disabled","no-remote-ejb","port-firewalled"],"who_is_affected":"Systems running WildFly with IIOP enabled and @Remote EJBs exposed over IIOP on port 3528 are exposed. Applications that do not use IIOP, or that keep the port behind a firewall, are less exposed. The sources do not list affected versions or a fixed release.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":4127,"output_tokens":596,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed WildFly versions and the IIOP configuration needed to be exposed in the NVD entry or the WildFly advisory.","search":"'-114488':12A,15A '-2026':11A,14A '3528':49B,104C 'accept':5A,81C 'allow':95C 'assert':34B,84C 'attack':46B,68C,100C 'auth':99C 'authent':9A,43B,71C,94C 'bypass':8A,70C 'call':4A 'check':41B 'context':39B,88C 'csiv2':29B,78C 'cve':10A,13A 'eap':21B 'ejb':3A,16B,59B,74C,115C 'everi':110C 'expos':57B,113C 'flaw':61C 'forg':6A 'found':63C 'host':25B 'ident':7A,33B,83C 'iiop':2A,17B,37B,56B,73C,112C 'iiop-expos':55B,111C 'imperson':51B,106C 'interceptor':31B,80C 'invoc':75C 'ittprincipalnam':35B,82C 'java':18B 'jboss':20B 'jboss-eap':19B 'level':93C 'port':48B,103C 'pre':98C 'pre-auth':97C 'princip':53B,108C 'remot':45B,58B,67C,114C 'runtim':22B 'secur':30B,79C 'self':24B 'self-host':23B 'servic':38B,87C 'transport':42B,92C 'transport-level':91C 'trust':32B 'verifi':90C 'wildfli':1A,26B,27B,65C 'without':40B,89C","nicknames":[],"mitigations":[],"who_affected":"WildFly or JBoss EAP servers with the iiop-openjdk subsystem enabled and caller propagation turned on (non-default), exposing @Remote EJBs over IIOP (port 3528) without client mutual TLS or mandatory authentication. Default configurations (caller-propagation=none) are not exposed per Red Hat. Teams not using IIOP or keeping 3528 firewalled can skip it. Affected and fixed versions are not published yet.","tier":"B","verified":{"mitigations":{"at":"2026-10-29T06:56:06Z","by":"analyst","doc":"https://access.redhat.com/security/cve/cve-2026-114488","run_id":1001},"how_to_check":{"at":"2026-10-29T06:56:06Z","by":"analyst","doc":"https://access.redhat.com/security/cve/cve-2026-114488","run_id":1001},"who_affected":{"at":"2026-10-29T06:56:06Z","by":"analyst","doc":"https://access.redhat.com/security/cve/cve-2026-114488","run_id":1001}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T06:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114488","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114488","severity":null,"published_at":"2026-10-29T06:17:19+00:00","modified_at":"2026-10-29T06:17:19+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","fetched_at":"2026-10-29T06:53:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114488:1001","url":null,"severity":null,"published_at":"2026-10-29T06:56:06+00:00","modified_at":"2026-10-29T06:56:06+00:00","first_seen_at":"2026-10-29T06:56:06+00:00","fetched_at":"2026-10-29T06:56:06+00:00","note":"Red Hat CVE page read: exposure needs non-default IIOP caller-propagation (default none) without mTLS/as-context; Red Hat rates Moderate. No affected/fixed versions published anywhere I found (WildFly 41.0.1/42 notes only list sibling CVEs 15560/15563/15567); fix unknown. Bugzilla 2491619 not read. Mitigation text from Red Hat."}],"documents":[{"id":14817,"url":"https://access.redhat.com/security/cve/cve-2026-114488","title":"Red Hat CVE-2026-114488","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":14817,"url":"https://access.redhat.com/security/cve/cve-2026-114488","title":"Red Hat CVE-2026-114488","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}