AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Red HatCVE-2026-15563

Red Hat JBoss Enterprise Application Platform 7.4.25: missing authentication

Red Hat

CVE-2026-15563 · Published Aug 11, 2026 · updated Nov 1, 2026

High7.4
No fix yet
Red Hat advisory

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.

Affected versions

PackageAffectedFixed in
Red Hat JBoss Enterprise Application Platform 7.4.25
Product
all versionsNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-306

More Red Hat advisories

All Red Hat
High 8.2Aug 11Red Hat FreeIPA: improper authorizationCVE-2026-19550no fix yetHigh 7.5Aug 11Red Hat search-v2-api. The authentication middleware: authentication bypassCVE-2026-71467no fix yetMedium 5.3Aug 11Red Hat acm-search-v2-api-rhel9.: information disclosureCVE-2026-71468no fix yetHigh 7.1Aug 11Red Hat insights-client.: information disclosureCVE-2026-71474no fix yetMedium 6.8Aug 11Red Hat insights-client. A compromised managed cluster: information disclosureCVE-2026-71475no fix yetMedium 6.3Aug 11Red Hat insights-client: secrets in logsCVE-2026-71845no fix yet