Live › vulnerability › CVE-2026-15564
WildFly's IIOP listener may deserialize attacker-supplied object streams before authentication is performed. An attacker who can reach the IIOP port may be able to run code through gadget chains in the classpath, if the target EJB accepts untyped method parameters.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Teams running WildFly or JBoss EAP with the iiop-openjdk subsystem enabled and the IIOP listener (default port 3528) reachable from networks they do not trust. Exploitation also needs an exposed EJB that accepts generic or untyped parameters and a usable gadget chain on the classpath. Red Hat says EAP's IIOP listener binds to localhost by default, so default setups are much less exposed. Teams with IIOP removed or firewalled can skip it.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and depending on the potential gadget chains available in the running classpath.
This page as .md · .json · in your agent: get_signal("CVE-2026-15564")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.