CVE Watch6 de nov. de 2026

CVE-2026-15564

Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to t

CVSS

7.4

Alta

EPSS

0.1%

KEV

—

Exploit Today

0-100

Publicado: 29 de out. de 2026 · Última mod.: 6 de nov. de 2026 · CWE-829

EPSS · 30d

0.1%EPSS · 30 dias0.1%

2026-10-292026-11-07

Descrição técnica

Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and depending on the potential gadget chains available in the running classpath.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1238584.4 MÉD

4.0%

——1In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects2d CVE-2026-1238545.5 MÉD

6.3%

——2In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module10h CVE-2026-1238537.8 ALT

6.8%

——2In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process1d CVE-2026-1238497.0 ALT

3.8%

——1In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers1d CVE-2026-1238433.3 BAI

3.9%

——1In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration2d CVE-2026-1238387.8 ALT

6.8%

——2In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file1d