TL;DR: CVE-2026-15555 allows remote code execution on every node of a JBoss EAP or WildFly cluster. The Infinispan session replication path deserializes replicated session data through the JBoss Marshalling River unmarshaller with no class filtering. An attacker who reaches the clustering network can inject a deserialization gadget chain that executes arbitrary code on every cluster node.

How the attack works

The mechanism is a classic Java deserialization exploit, but the attack surface is specific to WildFly and JBoss EAP clustering. When you run WildFly or JBoss EAP in a distributed configuration, the Infinispan session replication subsystem synchronizes HTTP session state across cluster nodes. It serializes session objects on one node and deserializes them on the others.

The deserialization uses JBoss Marshalling, specifically the River format implementation. The River unmarshaller accepts and instantiates any serializable class found in the incoming byte stream. There is no allowlist. No class filtering. No type restriction. Any class on the classpath is fair game.

An attacker who can deliver a crafted byte stream to the clustering network injects a gadget chain: a sequence of standard Java objects whose constructor or readObject methods chain together to achieve code execution. The Apache Commons Collections gadget chain, available on many JBoss EAP classpaths, is one such payload. The unmarshaller dutifully reconstructs each object in the chain, triggering the execution path.

Every node in the cluster deserializes the same replicated data. One crafted session payload reaches all nodes. The blast radius is the entire cluster.

Who is affected

JBoss EAP (Enterprise Application Platform) is Red Hat's flagship Java application server. Thousands of enterprises depend on it for mission-critical Java applications: banks, insurance companies, government agencies, telecom operators, and healthcare systems. WildFly is the upstream community project that shares the same codebase.

Any deployment running JBoss EAP or WildFly in a clustered configuration with Infinispan session replication is vulnerable. Standalone (non-clustered) deployments are not affected by this specific path because they do not participate in session replication.

The clustering network is the attack surface. If an attacker can reach the JGroups or Infinispan clustering port (typically a multicast or unicast configuration on ports like 7600, 23364, or custom configurations), they can deliver the payload. In practice, this means any attacker who has compromised a node on the same network segment, or who can reach the clustering interface through a misconfigured firewall rule, can attack the entire cluster.

No fixed versions have been announced as of publication. The vulnerability was published on August 11, 2026 via the CVE List V5. NVD enrichment is pending.

What to do

The fix requires patching the JBoss Marshalling River unmarshaller to implement class filtering, or restricting which classes can be deserialized during session replication. Until a patch is available, mitigate by:

• Isolate the clustering network. Ensure the JGroups and Infinispan clustering interfaces are on a dedicated, isolated network segment that only cluster nodes can reach. No host outside the cluster should have a network route to the clustering port.
• Enable JGroups encryption. If clustering traffic must traverse untrusted network segments, enable JGroups SYM_ENCRYPT or ASYM_ENCRYPT to authenticate and encrypt cluster communication. An attacker who cannot authenticate to the cluster cannot inject a crafted session payload.
• Remove unnecessary gadget libraries. Audit your JBoss EAP classpath for known gadget chain libraries (Apache Commons Collections, Commons BeanUtils, Groovy, Javassist). Remove or upgrade to versions that are not exploitable. This reduces the available gadget chains even if the unmarshaller itself remains unpatched.
• Monitor for clustering anomalies. Watch for unexpected session serialization events or deserialization failures in JBoss EAP logs, which may indicate an attacker probing the replication path.

Why it matters

Deserialization vulnerabilities remain one of the highest-impact bug classes in the Java ecosystem. This one is particularly dangerous because the attack is transitive across the cluster. A single compromised or reachable node becomes a launch point against every peer.

The vulnerability sits in a well-understood attack pattern. Java deserialization exploits have been weaponized since 2015, with toolkits like ysoserial providing ready-made gadget chains. The barrier to exploitation is low for anyone with network access to the clustering interface.

Red Hat has not yet assigned a CVSS score on hol.org. Based on the attack pattern (network access required, but full RCE on compromise with cluster-wide blast radius), this would likely score in the 8.x to 9.x range. The lack of a published CVSS at this time does not reduce the severity.

References

• CVE-2026-15555 on hol.org
• CVE-2026-15555 on NVD (pending enrichment)