High · CVSS 7.4CVE-2026-114488

Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport bindingCVE-2026-114488

Answer in brief

CVE-2026-114488 records a High severity (CVSS 7.4) vulnerability in Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding. The current sources do not mark it as known exploited. The current feed maps Red Hat/wildfly-iiop-openjdk (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Oct 29, 2026Updated Oct 29, 2026Source checked Oct 29, 2026First seen by HOL Oct 29, 2026Material review Oct 29, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 7.4
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Not reported

Why this deserves its current priority

CVSS is 7.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Red Hat/wildfly-iiop-openjdk (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Red Hat/wildfly-iiop-openjdkgeneric	*	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Red Hat/wildfly-iiop-openjdk.
Review the reported fix. Source-reported workaround: To mitigate this vulnerability without modifying binaries, apply one or more of the following operational and configuration controls: 1. Maintain or revert caller propagation to the default 'none' setting in the IIOP subsystem configuration: Run the following management CLI command: `/subsystem=iiop-openjdk:write-attribute(name=caller-propagation,value=none)` Ensure that application deployment descriptors (such as jboss-ejb3.xml) do not explicitly override caller propagation to 'supported'. 2. Restrict network reachability: Block external access to the CORBA/IIOP port (default TCP port 3528) using firewall rules, or restrict access strictly to trusted application networks: `firewall-cmd --remove-port=3528/tcp --permanent && firewall-cmd --reload` 3. Enforce transport-level security: If caller propagation is required for your architecture, configure the IIOP subsystem to require SSL/TLS with client certificate authentication by setting `server-requires-ssl="true"`, or enforce mandatory authentication via the `as-context` configuration. Caveats: Disabling caller propagation prevents client security identity forwarding across remote IIOP EJB calls, which may impact applications relying on distributed identity propagation. Restricting firewall access will prevent external clients outside authorized networks from connecting to IIOP services. Warning: Applying configuration changes via the JBoss management CLI requires reloading the runtime service (`:reload`), which will temporarily interrupt active client connections.

Evidence timeline and material changes

Published upstream
Oct 29, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Oct 29, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Oct 29, 2026

Sources and claim methodology

Upstream source description

A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to impersonate any principal on every IIOP-exposed @Remote EJB.

Quoted source text, attributed separately from HOL analysis.

Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserializationSame red hat/wildfly-iiop-openjdk package

Package

Affected range

Fixed version

Red Hat/wildfly-iiop-openjdkgeneric

Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Red Hat/wildfly-iiop-openjdk.

Review the reported fix. Source-reported workaround: To mitigate this vulnerability without modifying binaries, apply one or more of the following operational and configuration controls: 1. Maintain or revert caller propagation to the default 'none' setting in the IIOP subsystem configuration: Run the following management CLI command: `/subsystem=iiop-openjdk:write-attribute(name=caller-propagation,value=none)` Ensure that application deployment descriptors (such as jboss-ejb3.xml) do not explicitly override caller propagation to 'supported'. 2. Restrict network reachability: Block external access to the CORBA/IIOP port (default TCP port 3528) using firewall rules, or restrict access strictly to trusted application networks: `firewall-cmd --remove-port=3528/tcp --permanent && firewall-cmd --reload` 3. Enforce transport-level security: If caller propagation is required for your architecture, configure the IIOP subsystem to require SSL/TLS with client certificate authentication by setting `server-requires-ssl="true"`, or enforce mandatory authentication via the `as-context` configuration. Caveats: Disabling caller propagation prevents client security identity forwarding across remote IIOP EJB calls, which may impact applications relying on distributed identity propagation. Restricting firewall access will prevent external clients outside authorized networks from connecting to IIOP services. Warning: Applying configuration changes via the JBoss management CLI requires reloading the runtime service (`:reload`), which will temporarily interrupt active client connections.

Sources and claim methodology

Upstream source description

Quoted source text, attributed separately from HOL analysis.

Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport bindingCVE-2026-114488

Key facts

Why this deserves its current priority

Affected scope and exposure questions

Recommended response

Evidence timeline and material changes

Sources and claim methodology

Related CVEs

Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport bindingCVE-2026-114488

Key facts

Why this deserves its current priority

Affected scope and exposure questions

Recommended response

Evidence timeline and material changes

Sources and claim methodology

Related CVEs