What is the CVSS score of CVE-2026-24330?

CVE-2026-24330 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

WildFly Core CVE-2026-24330

EUVD-2026-55930 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-11 redhat

GHSA-ggg3-f99r-pw42

Java Red Hat File Upload Red Hat Fuse 7 Red Hat Jboss Enterprise Application Platform 8 Red Hat Jboss Enterprise Application Platform Expansion Pack Red Hat Single Sign On 7 Red Hat Jboss Enterprise Application Platform 7 Red Hat Process Automation 7 Red Hat

6.5

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable deployment endpoint (AV:N, AC:L) but PR:H required for the 'deployer' role; no availability impact described, and no scope change to external systems.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 03:36 vuln.today

CVE Published

Aug 11, 2026 - 02:35 nvd

MEDIUM 6.5

DescriptionCVE.org

A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive. This could lead to further exploitation, such as arbitrary file read vulnerabilities.

AnalysisAI

Unrestricted archive upload in WildFly Core enables authenticated 'deployer' role users to deploy malicious Java archives via HTTP POST requests, potentially achieving arbitrary file reads and further system compromise. Affected products span multiple Red Hat enterprise offerings including JBoss EAP 7 and 8, Red Hat Fuse 7, Process Automation 7, and Single Sign-On 7, all of which embed wildfly-core as a foundational dependency. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Technical ContextAI

WildFly Core is the foundational runtime component underlying multiple Red Hat enterprise Java middleware products. CWE-434 (Unrestricted Upload of File with Dangerous Type) identifies the root cause: the deployment subsystem fails to adequately validate the provenance or content of uploaded archives when processing requests from authenticated deployer accounts. An attacker exploits WildFly's own native deployment libraries to craft a specially constructed Java project - typically a WAR, EAR, or JAR archive - and submits it via HTTP POST to the management or deployment endpoint. Affected CPE entries confirm exposure across Red Hat Fuse 7, JBoss Enterprise Application Platform 7 and 8, JBoss EAP Expansion Pack, Red Hat Process Automation 7, and Red Hat Single Sign-On 7, all of which share the vulnerable wildfly-core code path.

RemediationAI

Apply the vendor-provided fix as documented in the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-24330 and the associated Bugzilla tracking issue at https://bugzilla.redhat.com/show_bug.cgi?id=2431939. No specific patched version numbers were enumerated in the available CVE data - patch version must be verified directly against the Red Hat advisory for the affected product line (JBoss EAP 7, JBoss EAP 8, Fuse 7, Process Automation 7, or Single Sign-On 7). As an immediate compensating control, administrators should audit and restrict the 'deployer' role: remove deployer access from any account that does not operationally require it, enforce strong credentials and multi-factor authentication on all accounts holding this role, and restrict the deployment endpoint at the network layer via firewall or reverse proxy rules to known-trusted source IP ranges only. If WildFly deployment policy supports restricting archive imports to pre-approved local repositories rather than arbitrary external URLs, enabling that restriction directly removes the untrusted-source import vector without requiring a full product upgrade.