What is the CVSS score of CVE-2026-15563?

CVE-2026-15563 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Red Hat EAP are affected by CVE-2026-15563?

Red Hat JBoss Enterprise Application Platform is vulnerable to unauthenticated JNDI namespace hijacking attacks, allowing threat actors to intercept communications between client applications and…. A patch is available.

How to fix or mitigate CVE-2026-15563?

Within 24 hours, identify all production and non-production JBoss EAP instances in your environment and determine which have IIOP NameService enabled or accessible from untrusted networks. Within 7 days, implement network-level compensating controls by restricting access to the IIOP NameService port (default 14250) to only authorized application clients using firewall rules and network segmentation, and enable detailed logging of all JNDI bind and lookup operations to detect suspicious activity. Within 30 days, monitor Red Hat security advisories for a vendor patch and schedule an upgrade window for affected systems; until a patch is available, evaluate whether IIOP NameService can be disabled if not essential to business operations.

Red Hat EAP CVE-2026-15563

EUVD-2026-55987 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-08-11 secalert@redhat.com

GHSA-259j-555g-mwrr

Authentication Bypass

7.4

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.7 HIGH

Adjusted A:N to A:L to reflect the description's explicit DoS pathway; all other NVD metrics are consistent with the unauthenticated IIOP bind flaw.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Red Hat

7.4 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 09:35 vuln.today

CVE Published

Aug 11, 2026 - 09:17 nvd

HIGH 7.4

DescriptionCVE.org

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.

AnalysisAI

IIOP NameService in Red Hat JBoss Enterprise Application Platform (EAP) accepts bind operations without authentication, allowing unauthenticated network attackers to register malicious CORBA object references under arbitrary JNDI names. When legitimate clients subsequently perform JNDI lookups, they resolve the attacker's malicious Object Request Broker (ORB), enabling man-in-the-middle interception of CORBA/RMI-IIOP invocations or denial-of-service on dependent application flows. EPSS data was not provided; no public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV.

Technical ContextAI

The Internet Inter-ORB Protocol (IIOP) is EAP's implementation of the CORBA wire protocol, enabling interoperability between distributed Java EE components and legacy CORBA systems. IIOP exposes a CORBA Naming Service (NameService) through which remote objects are registered and resolved via JNDI. CWE-306 (Missing Authentication for Critical Function) identifies the root cause: the NameService listener does not enforce any credential check before accepting bind() or rebind() operations, which are privileged mutation actions. An attacker exploiting this gap can inject a crafted ORB stub into the naming context tree. All subsequent lookups by EAP clients against that name path will dereference the attacker-controlled object reference, redirecting live RMI-IIOP calls through an adversary-controlled endpoint. Affected product CPE data was not included in the source intelligence; exact version ranges must be confirmed via the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15563.

RemediationAI

Apply the Red Hat-issued patch for EAP as documented at https://access.redhat.com/security/cve/CVE-2026-15563; a specific patched version number was not confirmed in the available intelligence data and must be retrieved directly from the Red Hat advisory. As an immediate compensating control, disable the IIOP subsystem entirely in the EAP standalone or domain configuration if CORBA/RMI-IIOP interoperability is not operationally required - this eliminates the attack surface with no impact on HTTP-based or EJB-over-HTTP workloads. If IIOP must remain active, restrict access to the IIOP listener port (typically 3528/3529) via host-based firewall or network ACL to only trusted internal service accounts; note that this mitigates remote exploitation but does not address insider or compromised-host scenarios. Monitor for unexpected JNDI binding activity in EAP logs as a detection signal. Track fix availability through the Red Hat bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2483138.