CVE-2026-15560 Red Hat CVE debrief

Who should care

Defenders responsible for Red Hat JBoss Enterprise Application Platform 7.4.25 deployments should assess exposure and apply security updates. This vulnerability may impact systems that rely on EJB security interceptors for authentication and authorization.

Why it matters

CVE-2026-15560 is a high-severity vulnerability in Red Hat JBoss Enterprise Application Platform 7.4.25 that allows an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM. Defenders should prioritize verifying exposure and applying security updates to prevent potential exploitation.

• Potential loading and instantiation of arbitrary classes from a remote URL
• Possible bypass of EJB security interceptors
• Unauthenticated access to sensitive data or functionality
• Verification of exposure and application of security updates is required

Technical summary

The openjdk-orb's JDKBridge in Red Hat JBoss Enterprise Application Platform 7.4.25 honours attacker-supplied CDR codebase URLs during object unmarshalling on port 3528. This allows an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run. The vulnerability is a result of the JDKBridge's handling of CDR codebase URLs, which enables an attacker to execute arbitrary code on the server. Defenders should prioritize verifying exposure of Red Hat JBoss Enterprise Application Platform 7.4.25 and applying security updates.

Defensive priority

Defenders should prioritize verifying exposure of Red Hat JBoss Enterprise Application Platform 7.4.25 and applying security updates.

Recommended defensive actions

• Verify exposure of Red Hat JBoss Enterprise Application Platform 7.4.25
• Apply security updates provided by Red Hat
• Monitor for potential exploitation attempts
• Review and update EJB security interceptors
• Perform a thorough review of the affected system's configuration and security settings
• Consider implementing additional security measures such as network segmentation or access controls
• Review and update incident response plans to address potential exploitation

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Red Hat JBoss Enterprise Application Platform 7.4.25. The openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.