JBoss EAP EUVD-2026-112635

Requires the target WildFly/JBoss EAP server to have IIOP (CORBA) EJB remoting enabled and the CSIv2 security interceptor reachable on TCP port 3528, with at least one @Remote EJB exposed over IIOP. Under those conditions an unauthenticated remote attacker (PR:N) can submit an ITTPrincipalName identity assertion in the service context and have it accepted without any transport-level authentication, impersonating any principal. The primary limiting factor is deployment exposure: IIOP/EJB-over-IIOP is not enabled in default standalone configurations, so only installations that have activated and network-exposed the IIOP subsystem are affected; no user interaction and no prior credentials are needed once the port is reachable.

This is a genuine high-priority authentication-bypass issue rather than an inflated CVSS score. The CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.4) marks it network-reachable and unauthenticated (PR:N) with high confidentiality and integrity impact and no availability impact - consistent with impersonation of arbitrary principals on @Remote EJBs. The decision framework assigns a 'this_week' priority from Red Hat, indicating meaningful but not emergency urgency. No EPSS probability, no CISA KEV listing, and no public exploit reference are provided, so there is no evidence of active exploitation or widespread automated weaponization; the risk is real but currently theoretical/targeted. One signal conflict must be flagged: the input Tags include 'Denial Of Service', which contradicts the CVSS vector (A:N) and the description (an identity-assertion impersonation flaw) - treat the DoS label as erroneous. The input's AC:H also sits awkwardly with the described trigger (the interceptor simply accepts an ITTPrincipalName assertion without transport authentication), which reads as low-complexity; the practical gating factor is deployment exposure of IIOP, not attack sophistication.

An attacker with network reach to a WildFly/JBoss EAP instance exposing IIOP on TCP port 3528 crafts a CSIv2 service-context carrying an ITTPrincipalName identity assertion naming a privileged principal. Because the security interceptor accepts the asserted identity without verifying transport-level authentication, the attacker invokes any IIOP-exposed @Remote EJB as that impersonated principal, reading or modifying data the EJB protects. No public exploit code is identified at time of analysis; exploitation requires IIOP/EJB remoting to be enabled and reachable.