What is the CVSS score of CVE-2026-15555?

CVE-2026-15555 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Infinispan are affected by CVE-2026-15555?

Red Hat Infinispan versions prior to the patched release contain a remote code execution vulnerability in session replication (CVE-2026-15555, CVSS 8.8) allowing attackers with adjacent-network…. A patch is available.

How to fix or mitigate CVE-2026-15555?

Within 24 hours, identify all Infinispan deployments in production, development, and test environments and verify which versions are affected; document cluster topology and peer network access paths. Within 7 days, implement network segmentation to restrict unauthenticated access to Infinispan cluster replication ports (typically 7800-7810), deploy network-based intrusion detection signatures monitoring for serialized gadget chain payloads on cluster traffic, and establish baseline monitoring of cluster nodes for unexpected process execution. Within 30 days, contact Red Hat for security advisory updates and patch availability timelines, prepare an upgrade testing plan once patches are released, and evaluate temporary architectural alternatives such as disabling cross-cluster session replication if business requirements permit.

Infinispan CVE-2026-15555

EUVD-2026-55982 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-11 secalert@redhat.com

GHSA-8qrr-8665-54fg

Deserialization

8.8

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

AV:A confirmed by cluster-replication architecture; PR:N because the replication channel has no authentication gate; full C/I/A:H reflects arbitrary RCE.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 09:33 vuln.today

CVE Published

Aug 11, 2026 - 09:17 nvd

HIGH 8.8

DescriptionCVE.org

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering - enabling RCE via deserialization gadget chains on every cluster node.

AnalysisAI

Remote code execution via unsafe Java deserialization affects Red Hat Infinispan's session replication path, where the JBoss Marshalling River unmarshaller processes replicated session data from cluster peers with no class allowlist or filtering. Any attacker with adjacen-network access to the Infinispan cluster replication channel can inject a crafted serialized payload exploiting standard Java gadget chains, achieving arbitrary code execution on every cluster node that deserializes the replicated data. No public exploit has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog, though its adjacency requirement limits blast radius to attackers already positioned on the cluster network.

Technical ContextAI

Infinispan is Red Hat's in-memory data grid used extensively in WildFly and JBoss EAP for distributed HTTP session replication across cluster nodes. The underlying serialization mechanism is JBoss Marshalling's River protocol, a high-performance Java serialization framework. CWE-502 (Deserialization of Untrusted Data) is the root cause: the River unmarshaller in the session-replication code path accepts arbitrary class payloads from the network without applying a class filter or allowlist, which is the standard Java deserialization defense codified in JEP 290. An attacker who can inject data into the Infinispan cluster replication channel can craft a serialized object graph exploiting known Java gadget chains - sequences of existing classes whose chained method invocations trigger arbitrary OS command execution during deserialization. Because replication propagates data to all participating nodes, a single malicious payload can detonate simultaneously across the entire cluster.

RemediationAI

Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-15555 and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2480637 for the authoritative patched version - no specific fix version was confirmed in the available intelligence at time of analysis. Until a patch is applied, consider the following compensating controls with their trade-offs: restrict access to the Infinispan cluster replication port (default JGroups ports, typically TCP/7600 or TCP/55200) at the network firewall or host-based firewall to only trusted cluster member IP addresses - this eliminates adjacent-network attacker access but requires accurate network inventory and does not protect against a compromised legitimate cluster node. Alternatively, deploy cluster communication over an encrypted and mutually authenticated channel (e.g., TLS with client certificates in JGroups SASL or ENCRYPT protocols) to prevent unauthenticated data injection; this is the recommended defense-in-depth posture even post-patch. Enabling JVM-level deserialization filters via JEP 290 (the jdk.serialFilter system property) as a JVM startup argument to restrict allowable classes can mitigate gadget-chain exploitation but requires careful tuning to avoid breaking legitimate deserialization. Monitor Red Hat Bugzilla 2480637 for patch release.