{"id":"CVE-2026-15564","kind":"vulnerability","aliases":["CVE-2026-15564"],"related":[],"title":"WildFly: IIOP listener may deserialize untrusted objects before authentication","description":"Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and depending on the potential gadget chains available in the running classpath.","summary":"WildFly's IIOP listener may deserialize attacker-supplied object streams before authentication is performed. An attacker who can reach the IIOP port may be able to run code through gadget chains in the classpath, if the target EJB accepts untyped method parameters.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ejb","iiop","java","jboss-eap","runtime","wildfly"],"not_affected_if":["iiop-disabled","localhost-only-default","no-untyped-ejb-parameters","port-not-reachable"],"how_to_check":"- Look for the iiop-openjdk subsystem in standalone.xml/domain.xml, or run: jboss-cli.sh --connect --command=\"/subsystem=iiop-openjdk:read-resource\".\n- Check whether TCP 3528 (default IIOP port) is reachable from untrusted networks. Red Hat says EAP binds IIOP to localhost by default.\n- Review EJBs exposed over IIOP for generic/untyped method parameters.","fix":null,"status":"open","published_at":"2026-10-29T06:17:20+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","triaged_at":"2026-10-29T06:54:30+00:00","updated_at":"2026-10-29T06:55:50+00:00","category":"runtime","confidence":0.75,"triage":{"at":"2026-10-29T06:54:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WildFly: IIOP listener may deserialize untrusted objects before authentication","impact":"high","summary":"WildFly's IIOP listener may deserialize attacker-supplied object streams before authentication is performed. An attacker who can reach the IIOP port may be able to run code through gadget chains in the classpath, if the target EJB accepts untyped method parameters.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wildfly","java","ejb","iiop"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the server through deserialization gadget chains","analyst_note":"Source is NVD only; check the WildFly security advisory for affected and fixed versions and the IIOP mitigation settings.","how_to_check":"- Check whether the IIOP listener is enabled in the WildFly configuration (`standalone.xml` or `domain.xml`, `iiop-openjdk` subsystem).\n- Check the running WildFly version with `standalone.sh --version` or the management console.\n- Check whether the IIOP port is reachable from untrusted networks.\n- Review EJBs exposed over IIOP for untyped method parameters.","plain_action":"","needs_analyst":true,"not_affected_if":["iiop-disabled","port-not-reachable","no-untyped-ejb-parameters"],"who_is_affected":"Teams running WildFly with the IIOP listener enabled and an IIOP port reachable from networks they do not trust. The sources say exposure depends on EJBs that accept untyped method parameters and on gadget chains in the running classpath. Deployments with IIOP disabled or the port limited to trusted networks are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000732,"input_tokens":4122,"output_tokens":640,"severity_before":"high"},"analyst_status":"done","analyst_note":"Source is NVD only; check the WildFly security advisory for affected and fixed versions and the IIOP mitigation settings.","search":"'-15564':12A,15A '-2026':11A,14A 'abl':49B,93C 'accept':63B 'access':86C 'achiev':101C 'allow':107C 'attack':31B,40B,82C 'attacker-suppli':30B 'authent':9A,36B,78C 'avail':118C 'chain':55B,117C 'classpath':58B,122C 'code':52B 'construct':95C 'cve':10A,13A 'depend':112C 'deseri':5A,29B,73C,102C 'eap':21B 'ejb':16B,62B,106C 'gadget':54B,116C 'gain':85C 'iiop':2A,17B,26B,45B,69C,89C 'input':75C 'java':18B 'jboss':20B 'jboss-eap':19B 'listen':3A,27B,70C 'malici':98C 'may':4A,28B,47B,71C,91C 'method':65B,109C 'object':7A,33B,99C 'paramet':66B,110C 'perform':38B,80C 'permit':72C 'port':46B,90C 'potenti':115C 'reach':43B 'run':51B,121C 'runtim':22B 'send':97C 'stream':34B,76C 'suppli':32B 'target':61B,105C 'untrust':6A 'untyp':64B,108C 'wildfli':1A,23B,24B,67C","nicknames":[],"mitigations":[],"who_affected":"Teams running WildFly or JBoss EAP with the iiop-openjdk subsystem enabled and the IIOP listener (default port 3528) reachable from networks they do not trust. Exploitation also needs an exposed EJB that accepts generic or untyped parameters and a usable gadget chain on the classpath. Red Hat says EAP's IIOP listener binds to localhost by default, so default setups are much less exposed. Teams with IIOP removed or firewalled can skip it.","tier":"B","verified":{"mitigations":{"at":"2026-10-29T06:55:50Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-15564","run_id":1000},"how_to_check":{"at":"2026-10-29T06:55:50Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-15564","run_id":1000},"who_affected":{"at":"2026-10-29T06:55:50Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-15564","run_id":1000}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T06:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-15564","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15564","severity":null,"published_at":"2026-10-29T06:17:20+00:00","modified_at":"2026-10-29T06:17:20+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","fetched_at":"2026-10-29T06:53:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-15564:1000","url":null,"severity":null,"published_at":"2026-10-29T06:55:50+00:00","modified_at":"2026-10-29T06:55:50+00:00","first_seen_at":"2026-10-29T06:55:50+00:00","fetched_at":"2026-10-29T06:55:50+00:00","note":"Red Hat CVE page read: no fixed version published yet (fix_status none); Red Hat rates it Moderate, CVSS 7.4 AV:L. Mitigation: firewall port 3528 or remove the iiop-openjdk subsystem. Sibling IIOP CVEs 15560/15563/15567 are in WildFly 41.0.1.Final; 15564 not listed in what I read, so fix version unknown. No exploitation or PoC found."}],"documents":[{"id":14816,"url":"https://access.redhat.com/security/cve/CVE-2026-15564","title":"CVE-2026-15564 - Red Hat Customer Portal","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}