CVE-2026-15555CWE-502insecure-deserialization

CVE-2026-15555

High · published August 11, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
23.6
In the wild
Unconfirmed
What it is

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00319 · 23.6th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-08-11T13:17Z
References (10)
https://access.redhat.com/errata/RHSA-2026:53644 · [email protected]https://access.redhat.com/errata/RHSA-2026:53645 · [email protected]https://access.redhat.com/errata/RHSA-2026:53646 · [email protected]https://access.redhat.com/errata/RHSA-2026:53806 · [email protected]https://access.redhat.com/errata/RHSA-2026:70228 · [email protected]https://access.redhat.com/errata/RHSA-2026:70229 · [email protected]https://access.redhat.com/errata/RHSA-2026:70230 · [email protected]https://access.redhat.com/errata/RHSA-2026:70277 · [email protected]https://access.redhat.com/security/cve/CVE-2026-15555 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2480637 · [email protected]
EPSS history
Timeline
  • 11 AUG 08:49Z
    Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller
    cvelistv5