cvesecurityvulnerability
CVE-2026-15555: JBoss EAP Deserialization RCE via Unfiltered River Unmarshaller in Session Replication
JBoss EAP and WildFly cluster deserialization RCE. The Infinispan session replication path deserializes through JBoss Marshalling River unmarshaller with no class filtering. Network access to the clustering port yields code execution on every cluster node.
