CVE Watch6 de nov. de 2026

CVE-2026-114488

A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts I

CVSS

7.4

Alta

EPSS

0.4%

p35

KEV

—

Exploit Today

0-100

Publicado: 29 de out. de 2026 · Última mod.: 6 de nov. de 2026 · CWE-829

EPSS · 30d

0.3%EPSS · 30 dias0.4%

2026-10-292026-11-07

Descrição técnica

A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to impersonate any principal on every IIOP-exposed @Remote EJB.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1238584.4 MÉD

4.0%

——1In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects2d CVE-2026-1238545.5 MÉD

6.3%

——2In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module10h CVE-2026-1238537.8 ALT

6.8%

——2In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process1d CVE-2026-1238497.0 ALT

3.8%

——1In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers1d CVE-2026-1238433.3 BAI

3.9%

——1In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration2d CVE-2026-1238387.8 ALT

6.8%

——2In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file1d