HIGHCVSS v3.1 7.4Vulnerability
CVE-2026-15564
Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and depending on the potential gadget chains available in the running classpath.
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-10-29T07:47:25.892024+00:00
- Cvss severity
- HIGH
- Cvss score
- 7.4
- Retrieved at
- 2026-10-29T07:48:21+00:00
- Score
- 7.4
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-15564
- Cvss vector
- CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-10-29T07:48:21+00:00
- Vector
- CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Published at
- 2026-10-29T06:17:20.590
- Last modified
- 2026-10-29T06:17:20.750
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph