IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
7.4High

CVE-2026-15563Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos

Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25; Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7; Red Hat Red Hat JBoss En… Published: (3 months ago)

Description

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.

Weakness (CWE): CWE-306

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
jboss enterprise application platform 8.1 —
jboss enterprise application platform els 7.4 —
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 —
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1.8.GA all versions
red hat single sign on 7.6 —
rhosemc 1.0 —

References and patches