CVE-2025-23368 Red Hat CVE debrief

Who should care

Organizations running WildFly Core versions prior to 31.0.3, Red Hat JBoss Enterprise Application Platform 7.x or 8.x, or Red Hat Data Grid 8.0 with exposed CLI interfaces. Security teams responsible for Java application server infrastructure and identity management administrators using Elytron-based authentication.

Technical summary

The WildFly Elytron security framework fails to implement adequate protections against rapid successive authentication failures through its command-line interface. This deficiency enables attackers to conduct brute-force credential guessing attacks without triggering account lockouts or significant delays. The vulnerability is remotely exploitable over the network with high attack complexity, requiring no user interaction or privileges. Successful exploitation grants complete system compromise (confidentiality, integrity, and availability). The issue was resolved in WildFly Core 31.0.3 and addressed through Red Hat security advisories for affected enterprise products.

Defensive priority

HIGH

Recommended defensive actions

• Apply Red Hat security advisories RHSA-2026:18054, RHSA-2026:18055, or RHSA-2026:18059 as applicable to your product version
• Upgrade WildFly Core to version 31.0.3 or later
• Implement network-level rate limiting and monitoring for CLI access attempts
• Enable account lockout policies and failed authentication alerting in WildFly Elytron configuration
• Restrict CLI access to administrative hosts via firewall rules or network segmentation
• Review authentication logs for anomalous CLI access patterns indicative of brute-force activity

Evidence notes

CVE published 2025-03-04; modified 2026-05-18. CPE criteria confirm affected versions: WildFly Core <31.0.3, Data Grid 8.0, JBoss EAP 7.0.0 and 8.0.0. CVSS 8.1 HIGH severity. CWE-307: Improper Restriction of Excessive Authentication Attempts.

Official resources