A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Redhat
  • Jboss Enterprise Application Platform
  • Jboss Enterprise Application Platform Els
  • Jboss Enterprise Application Platform Expansion Pack
  • Jboss Fuse
  • Jbosseapxp
  • Red Hat Single Sign On

No data.

No data.

References
Link Providers
https://access.redhat.com/errata/RHSA-2026:53644 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:53806 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2026-15563 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2483138 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-15563 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-15563 cve-icon
History

Thu, 03 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat jboss Fuse
Redhat red Hat Single Sign On
CPEs cpe:/a:redhat:jboss_fuse:7
cpe:/a:redhat:red_hat_single_sign_on:7
Vendors & Products Redhat jboss Fuse
Redhat red Hat Single Sign On

Mon, 24 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7

Wed, 12 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
References

Tue, 11 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Els
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
Vendors & Products Redhat jboss Enterprise Application Platform Els
References

Tue, 11 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 11 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 11 Aug 2026 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Expansion Pack
Vendors & Products Redhat jboss Enterprise Application Platform Expansion Pack

Tue, 11 Aug 2026 09:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.
Title Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos
First Time appeared Redhat
Redhat jboss Enterprise Application Platform
Redhat jbosseapxp
Weaknesses CWE-306
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:jbosseapxp
Vendors & Products Redhat
Redhat jboss Enterprise Application Platform
Redhat jbosseapxp
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2026-08-11T08:49:54.409Z

Updated: 2026-09-04T08:18:40.326Z

Reserved: 2026-07-13T05:38:15.921Z

Link: CVE-2026-15563

cve-icon Vulnrichment

Updated: 2026-08-11T16:51:52.668Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-11T09:17:13.233

Modified: 2026-09-04T09:17:10.217

Link: CVE-2026-15563

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-11T05:54:01Z

Links: CVE-2026-15563 - Bugzilla