---
id: "CVE-2026-15564"
kind: "vulnerability"
aliases: ["CVE-2026-15564"]
title: "WildFly: IIOP listener may deserialize untrusted objects before authentication"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ejb", "iiop", "java", "jboss-eap", "runtime", "wildfly"]
not_affected_if: ["iiop-disabled", "localhost-only-default", "no-untyped-ejb-parameters", "port-not-reachable"]
published_at: "2026-10-29T06:17:20+00:00"
first_seen_at: "2026-10-29T06:53:13+00:00"
updated_at: "2026-10-29T06:55:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15564", "first_seen_at": "2026-10-29T06:53:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T06:55:50+00:00"}]
---

# WildFly: IIOP listener may deserialize untrusted objects before authentication

WildFly's IIOP listener may deserialize attacker-supplied object streams before authentication is performed. An attacker who can reach the IIOP port may be able to run code through gadget chains in the classpath, if the target EJB accepts untyped method parameters.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for the iiop-openjdk subsystem in standalone.xml/domain.xml, or run: jboss-cli.sh --connect --command="/subsystem=iiop-openjdk:read-resource".
- Check whether TCP 3528 (default IIOP port) is reachable from untrusted networks. Red Hat says EAP binds IIOP to localhost by default.
- Review EJBs exposed over IIOP for generic/untyped method parameters.

## Timeline

- 2026-10-29T06:53:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-15564
- 2026-10-29T06:55:50+00:00 analyst — Red Hat CVE page read: no fixed version published yet (fix_status none); Red Hat rates it Moderate, CVSS 7.4 AV:L. Mitigation: firewall port 3528 or remove the iiop-openjdk subsystem. Sibling IIOP CVEs 15560/15563/15567 are in WildFly 41.0.1.Final; 15564 not listed in what I read, so fix version unknown. No exploitation or PoC found.

## Documents

- [advisory] CVE-2026-15564 - Red Hat Customer Portal https://access.redhat.com/security/cve/CVE-2026-15564

## From the sources

Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and depending on the potential gadget chains available in the running classpath.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_