CVE-2026-15554

HIGH

Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-15554 has a selected CVSS score of 7.4 (high).

Description

the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 11, 2026 · Source: CVE List

Affected products and versions

Showing 12 of 20
ProductSourceVersion range

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7

Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-activemq-artemis

Default status: affected

CVE List0:2.16.0-22.redhat_00057.1.el7eap to < *unaffected

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7

Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-glassfish-jsf

Default status: affected

CVE List0:2.3.14-11.SP11_redhat_00001.1.el7eap to < *unaffected

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7

Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-ironjacamar

Default status: affected

CVE List0:1.5.26-2.Final_redhat_00001.1.el7eap to < *unaffected

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7

Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-jackson-annotations

Default status: affected

CVE List0:2.18.8-1.redhat_00003.1.el7eap to < *unaffected

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7

Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-jackson-core

Default status: affected

CVE List0:2.18.8-1.redhat_00003.1.el7eap to < *unaffected

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7

Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-jackson-databind

Default status: affected

CVE List0:2.18.8-1.redhat_00003.1.el7eap to < *unaffected

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7

Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-jackson-jaxrs-providers

Default status: affected

CVE List0:2.18.8-1.redhat_00003.1.el7eap to < *unaffected

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7

Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-jackson-modules-base

Default status: affected

CVE List0:2.18.8-1.redhat_00003.1.el7eap to < *unaffected

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7

Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-jackson-modules-java8

Default status: affected

CVE List0:2.18.8-1.redhat_00003.1.el7eap to < *unaffected

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7

Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-jboss-remoting

Default status: affected

CVE List0:5.0.31-3.SP2_redhat_00001.1.el7eap to < *unaffected

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7

Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-jboss-server-migration

Default status: affected

CVE List0:1.10.0-46.Final_redhat_00044.1.el7eap to < *unaffected

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7

Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-netty

Default status: affected

CVE List0:4.1.135-1.Final_redhat_00001.1.el7eap to < *unaffected

References

5