CVE-2026-15555 Red Hat CVE debrief

Who should care

Defenders of systems using Red Hat JBoss Enterprise Application Platform 7.4.25 should assess exposure and prioritize remediation. The vulnerability has a high CVSS score of 8.8 and is considered a high-severity vulnerability. Operators, platform administrators, and security teams should review the vulnerability and apply patches or mitigations accordingly.

Why it matters

CVE-2026-15555 is a high-severity vulnerability in JBoss marshalling that allows for remote code execution. Defenders of systems using Red Hat JBoss Enterprise Application Platform 7.4.25 should assess exposure and prioritize remediation.

• Remote code execution via deserialization gadget chains
• Potential for unauthorized access and data breaches
• Need for urgent remediation and patching

Technical summary

The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering, enabling RCE via deserialization gadget chains on every cluster node. This allows for remote code execution on every cluster node. The vulnerability is caused by the lack of class filtering in the JBoss Marshalling River unmarshaller. Red Hat JBoss Enterprise Application Platform 7.4.25 is affected by this vulnerability. Users should assess exposure and prioritize remediation.

Defensive priority

High priority for systems using Red Hat JBoss Enterprise Application Platform 7.4.25

Recommended defensive actions

• Assess exposure of Red Hat JBoss Enterprise Application Platform 7.4.25
• Prioritize remediation based on system criticality
• Verify and apply Red Hat errata for affected versions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Red Hat has released errata for affected versions. The vulnerability has a high CVSS score of 8.8 and is considered a high-severity vulnerability. Defenders should verify the affected scope and apply patches or mitigations accordingly. The CVE record was published on 2026-08-11T09:17:12.540Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.