CVE-2026-15555: JBoss Marshaller RCE via Infinispan deserialization
CVE-2026-15555 Published on August 11, 2026

Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering enabling RCE via deserialization gadget chains on every cluster node.

Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

Attack Vector:

ADJACENT_NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

HIGH

Timeline

2026-05-21

Reported to Red Hat.

2026-08-11

Made public. 82 days later.

Weakness Type

What is a Marshaling, Unmarshaling Vulnerability?

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

CVE-2026-15555 has been classified to as a Marshaling, Unmarshaling vulnerability or weakness.

Products Associated with CVE-2026-15555

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Jboss Enterprise Application Platform

Red Hat Jbosseapxp

Red Hat Jboss Enterprise Application Platform Els

Affected Versions

Red Hat JBoss Enterprise Application Platform 7.4.25: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.16.0-22.redhat_00057.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.3.14-11.SP11_redhat_00001.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:1.5.26-2.Final_redhat_00001.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.18.8-1.redhat_00003.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.18.8-1.redhat_00003.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.18.8-1.redhat_00003.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.18.8-1.redhat_00003.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.18.8-1.redhat_00003.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.18.8-1.redhat_00003.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:5.0.31-3.SP2_redhat_00001.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:1.10.0-46.Final_redhat_00044.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:4.1.135-1.Final_redhat_00001.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:4.1.135-1.Final_redhat_00001.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.5.5-30.SP12_redhat_00020.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.5.5-24.SP12_redhat_00016.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.2.40-2.SP3_redhat_00001.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:7.4.25-2.GA_redhat_00001.1.el7eap and below * is unaffected.

Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 8: Red Hat JBoss Enterprise Application Platform 8: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat JBoss Enterprise Application Platform Expansion Pack: