EUVD-2026-55929
GHSA-g28c-9r5g-f43w
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
PR:H confirmed by admin-only access requirement; I:L added because malformed payload permanently corrupts standalone.xml, constituting a minor integrity impact the vendor vector omits.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml configuration file. Manual intervention is required to restore server operation, leading to a denial of service.
AnalysisAI
Denial of service in WildFly Core (and downstream Red Hat middleware products) allows a remote administrative user to render a server permanently unrecoverable by injecting a malformed payload into the Inet Address field of the Management Model. The injected payload is persisted to standalone.xml, corrupting the configuration file and preventing normal server restart without manual intervention. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid administrative account on the WildFly/JBoss Management API - CVSS PR:H confirms high-privilege authentication is mandatory, making unauthenticated or low-privilege exploitation impossible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) yields a base score of 4.9, which accurately reflects the constrained threat model: exploitation requires high-privilege (administrative) credentials, making it inaccessible to most external attackers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained valid administrative credentials - whether through credential theft, phishing of an ops team member, or lateral movement from a compromised admin workstation - authenticates to the JBoss EAP Management API over the network and submits a crafted Inet Address value containing malformed XML characters. The payload is accepted and written to standalone.xml; the server subsequently fails to parse its own configuration and enters an unrecoverable crash state, taking down all hosted applications until an operator manually corrects the file on disk. … |
| Remediation | Consult the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-24329 for product-specific patched versions across JBoss EAP 7, EAP 8, Fuse 7, Process Automation 7, and SSO 7 - no exact fix version is confirmed in available data, so treat vendor guidance as authoritative. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Fuse 7
View allHTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Remote code execution in Red Hat Apache Camel Infinispan component allows low-privileged attackers to execute arbitrary
Unrestricted archive upload in WildFly Core enables authenticated 'deployer' role users to deploy malicious Java archive
Medium severity vulnerability in systemd. A container privilege escalation flaw was found in certain Fuse images. This i
HTTP request smuggling in Undertow's ChunkReader component enables unauthenticated remote attackers to inject out-of-syn
Same weakness CWE-91 – XML Injection (aka Blind XPath Injection)
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today