RHSA-2026:53644Vendor advisory
https://access.redhat.com/errata/RHSA-2026:53644 CVE-2026-15560
HIGH
Openjdk-orb: unauthed class loading via iiop in eap
Record summary
CVE-2026-15560 has a selected CVSS score of 8.1 (high).
Description
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 12, 2026 · Source: CVE List
Affected products and versions
Showing 12 of 20| Product | Source | Version range | Status |
|---|---|---|---|
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-activemq-artemisDefault status: affected | CVE List | 0:2.16.0-22.redhat_00057.1.el7eap to < * | unaffected |
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-glassfish-jsfDefault status: affected | CVE List | 0:2.3.14-11.SP11_redhat_00001.1.el7eap to < * | unaffected |
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-ironjacamarDefault status: affected | CVE List | 0:1.5.26-2.Final_redhat_00001.1.el7eap to < * | unaffected |
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-jackson-annotationsDefault status: affected | CVE List | 0:2.18.8-1.redhat_00003.1.el7eap to < * | unaffected |
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-jackson-coreDefault status: affected | CVE List | 0:2.18.8-1.redhat_00003.1.el7eap to < * | unaffected |
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-jackson-databindDefault status: affected | CVE List | 0:2.18.8-1.redhat_00003.1.el7eap to < * | unaffected |
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-jackson-jaxrs-providersDefault status: affected | CVE List | 0:2.18.8-1.redhat_00003.1.el7eap to < * | unaffected |
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-jackson-modules-baseDefault status: affected | CVE List | 0:2.18.8-1.redhat_00003.1.el7eap to < * | unaffected |
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-jackson-modules-java8Default status: affected | CVE List | 0:2.18.8-1.redhat_00003.1.el7eap to < * | unaffected |
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-jboss-remotingDefault status: affected | CVE List | 0:5.0.31-3.SP2_redhat_00001.1.el7eap to < * | unaffected |
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-jboss-server-migrationDefault status: affected | CVE List | 0:1.10.0-46.Final_redhat_00044.1.el7eap to < * | unaffected |
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7eap7-nettyDefault status: affected | CVE List | 0:4.1.135-1.Final_redhat_00001.1.el7eap to < * | unaffected |
References
5RHSA-2026:53806Vendor advisory
https://access.redhat.com/errata/RHSA-2026:53806 access.redhat.comvdb entry
https://access.redhat.com/security/cve/CVE-2026-15560 RHBZ#2483131issue tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2483131 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-15560