EUVD-2026-55982
GHSA-8qrr-8665-54fg
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:A confirmed by cluster-replication architecture; PR:N because the replication channel has no authentication gate; full C/I/A:H reflects arbitrary RCE.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering - enabling RCE via deserialization gadget chains on every cluster node.
AnalysisAI
Remote code execution via unsafe Java deserialization affects Red Hat Infinispan's session replication path, where the JBoss Marshalling River unmarshaller processes replicated session data from cluster peers with no class allowlist or filtering. Any attacker with adjacen-network access to the Infinispan cluster replication channel can inject a crafted serialized payload exploiting standard Java gadget chains, achieving arbitrary code execution on every cluster node that deserializes the replicated data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network adjacency to the Infinispan cluster replication channel - the attacker must be able to reach the cluster replication port (JGroups transport), which is typically bound to internal network interfaces only. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately reflects the technical severity: no authentication or user interaction is required, and exploitation is low complexity once the attacker is adjacent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with access to the internal network VLAN hosting an Infinispan cluster - for example, a compromised internal workstation, a rogue VM in a multi-tenant environment, or a lateral-movement pivot from a DMZ host - sends a crafted JBoss Marshalling River-encoded payload to the cluster replication port containing a classic Java deserialization gadget chain. Each cluster node that receives and deserializes the replicated session data executes arbitrary OS commands as the JVM process user, giving the attacker simultaneous shell access across the full cluster. … |
| Remediation | Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-15555 and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2480637 for the authoritative patched version - no specific fix version was confirmed in the available intelligence at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Infinispan deployments in production, development, and test environments and verify which versions are affected; document cluster topology and peer network access paths. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today