CVE-2015-7450

CRITICAL
2016-01-02 [email protected]
9.8
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Mar 26, 2026 - 11:18 vuln.today
Added to CISA KEV
Oct 22, 2025 - 00:15 cisa
CISA KEV
PoC Detected
Oct 22, 2025 - 00:15 vuln.today
Public exploit code
CVE Published
Jan 02, 2016 - 21:59 nvd
CRITICAL 9.8

Description

Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.

Analysis

Multiple IBM products are vulnerable to Java deserialization attacks via the Apache Commons Collections InvokerTransformer class, allowing unauthenticated remote code execution through serialized-object interfaces.

Technical Context

The CWE-502 deserialization vulnerability exploits the InvokerTransformer class in Apache Commons Collections, which allows arbitrary method invocation during object deserialization. When IBM products expose Java serialization endpoints (JMX, RMI, custom protocols), attackers can send crafted serialized payloads to execute OS commands.

Affected Products

['Multiple IBM analytics products', 'IBM business solutions', 'IBM cognitive products', 'IBM IT infrastructure products', 'IBM mobile and social products']

Remediation

Apply IBM security patches. Update Apache Commons Collections to 3.2.2+ or 4.1+ which disable InvokerTransformer by default. Use serialization filters (JEP 290) on Java 9+ to restrict deserializable classes.

Priority Score

222
Low Medium High Critical
KEV: +50
EPSS: +93.5
CVSS: +49
POC: +20

Share

CVE-2015-7450 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy