JBoss EAP EUVD-2026-112634

Requires an already-authenticated JBoss EAP management account with at least a low-privileged role such as Monitor, plus network reachability to the management interface; the attacker then calls the read-resource operation on the platform-mbean runtime management resource, whose handler omits the RBAC check. Exploitation is limited by that authentication requirement (PR:L - no anonymous access) and is confined to reading data: there is no write, code-execution, or denial-of-service path (I:N/A:N). The practical value of the disclosed data depends on whether the deployment stores sensitive values in JVM system properties.

This is a genuine but moderate-priority information-disclosure issue rather than a high-urgency flaw. The CVSS 3.1 base score is 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N: exploitation is network-reachable and low-complexity, but PR:L means the attacker must already hold a valid, authenticated management account (e.g. the Monitor role), and impact is confined to confidentiality (I:N/A:N) - there is no integrity or availability effect and no scope change. The vuln.today decision label is 'this_month', not act_now or emergency, which is consistent with the limited impact. No EPSS score, no CISA KEV listing, and no proof-of-concept were supplied in the input - the only two references are the Red Hat CVE advisory and a Red Hat Bugzilla entry, neither of which is verified exploit code. Signals are therefore internally consistent rather than conflicting: a medium CVSS, a 'this_month' priority, no active-exploitation evidence, and authentication-gated confidentiality-only impact all point the same way. The main caveat is that the real sensitivity depends on what the exposed JVM system properties contain in a given deployment - if operators store secrets (passwords, tokens) in system properties, a low-privileged monitor account could harvest them, which justifies Red Hat's C:H rating; in deployments with only benign configuration data the practical confidentiality loss is lower. EPSS and KEV absence is noted but not treated as an error - absence of those signals is expected for a freshly disclosed, authentication-gated disclosure bug.

An insider or a compromised account holding only the low-privileged Monitor role connects to the JBoss EAP management interface and issues a read-resource operation against the platform-mbean runtime management resource. Because the handler skips the required RBAC check, the server returns JVM configuration and system properties that the Monitor role should not be able to see, potentially including secrets stored as system properties. No public exploit identified at time of analysis, and the attack requires valid authenticated management credentials.