JBoss EAP (WildFly) CVE-2026-15564

Exploitation requires three concrete, stacked prerequisites drawn from the description: (1) the attacker must be able to reach the WildFly/JBoss EAP IIOP (CORBA) listener port; (2) the target EJB must expose at least one method that accepts untyped method parameters (e.g. java.lang.Object), since the deserialization occurs on such input; and (3) a usable gadget chain must exist in the running application's classpath to turn deserialization into meaningful impact. The flaw occurs before authentication is performed (PR:N), so no credentials are needed once the port is reachable. Limiting factors that reduce real-world risk: IIOP is not enabled or network-exposed in every deployment, applications that do not expose untyped EJB parameters are not affected, and absence of an exploitable gadget chain in the classpath can prevent escalation beyond the deserialization itself - these conditions are why the vendor assigned AC:H.

This is a genuine but conditional priority, not a trivially exploitable critical flaw. The vendor (Red Hat) CVSS is 7.4 with vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, and the vuln.today decision label is 'this_week' rather than act_now/emergency. The signals partly conflict: the CVSS vector encodes AV:L (local attack vector), yet the description explicitly says 'an attacker who can gain access to the IIOP port may be able to construct and send malicious objects' - IIOP is a network-exposed protocol, which points to a network vector (AV:N). This discrepancy should be verified with Red Hat; if the IIOP port is reachable across the network the real-world exposure is higher than AV:L implies. AC:H is consistent with the description's stacked preconditions (the target EJB must accept untyped/Object method parameters, and a usable gadget chain must exist in the running classpath). PR:N (pre-authentication deserialization) is the most serious attribute: the flaw occurs before authentication, so no credentials are needed once the port is reachable. No EPSS score, CISA KEV listing, SSVC automatable/technical-impact breakdown, or POC/exploit reference is present in the input. Absence of KEV/EPSS/POC is not evidence of safety, but it does mean there is no current signal of mass or active exploitation; combined with AC:H this reads as a serious server-side RCE-class deserialization bug whose practical exploitation is gated by configuration and classpath rather than a widely-weaponized threat.

An attacker with network or local reachability to the WildFly/JBoss EAP IIOP port sends a crafted, malicious serialized object to an EJB that exposes an untyped (Object) method parameter, causing the IIOP listener to deserialize attacker-controlled data before any authentication check. If a suitable gadget chain is present in the running classpath, this deserialization can be leveraged to compromise confidentiality, integrity and availability of the server (RCE-class impact). No public exploit was identified in the provided data, and success depends on the EJB accepting untyped parameters and the availability of an exploitable gadget chain.