PatchSiren cyber security CVE debrief
CVE-2026-15554 Red Hat CVE debrief
The CVE-2026-15554 vulnerability affects the Undertow AJP listener, which honors forged ssl_cert and is_ssl AJP attributes without requiring shared-secret authentication. This high-severity issue enables unauthenticated attackers with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol. The CVE record was published on 2026-08-11T09:17:12.400Z and has not been modified since then. The NVD entry is currently Awaiting Analysis. Administrators and security teams should assess their exposure, review configurations, and implement necessary mitigations.
- Vendor
- Red Hat
- Product
- Red Hat JBoss Enterprise Application Platform 7.4.25
- CVSS
- HIGH 7.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-11
- Original CVE updated
- 2026-08-24
- Advisory published
- 2026-08-11
- Advisory updated
- 2026-08-24
Who should care
Administrators and security teams responsible for Undertow AJP listener configurations, particularly those using CLIENT-CERT authentication, should be aware of this high-severity vulnerability. They should assess their exposure, review configurations, and implement necessary mitigations to prevent potential authentication bypass attacks.
Technical summary
The Undertow AJP listener honors forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication, enabling unauthenticated attackers with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol. This issue affects deployments using CLIENT-CERT authentication with direct TCP access to port 8009. Defenders should verify AJP listener configurations, authentication mechanisms, and network exposure to assess potential impact and implement mitigations. The vulnerability has a CVSS score of 7.4 and is classified as HIGH severity.
Defensive priority
Unauthenticated attackers with direct TCP access to port 8009 can bypass CLIENT-CERT authentication by injecting forged X.509 certificates via the AJP protocol, indicating a high-severity vulnerability.
Recommended defensive actions
- Verify and restrict access to port 8009 to trusted sources only.
- Implement shared-secret authentication for AJP protocol.
- Monitor for and respond to potential authentication bypass attempts.
- Review and update CLIENT-CERT authentication configurations.
- Consider compensating controls such as IP restrictions or additional authentication layers.
- Review AJP listener configurations for exposure and implement network restrictions.
- Track exceptions and retest remediated assets after verification.
Evidence notes
The Undertow AJP listener honors forged ssl_cert and is_ssl AJP attributes without requiring shared-secret authentication, allowing unauthenticated attackers to bypass CLIENT-CERT authentication. This issue affects deployments using CLIENT-CERT authentication with direct TCP access to port 8009. Defenders should verify AJP listener configurations, authentication mechanisms, and network exposure to assess potential impact and implement mitigations.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-11T09:17:12.400Z and has not been modified since then.