CVE-2026-15555: Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.
Other sources
indepth analysis: https://docs.google.com/document/d/1XdX8AJzGjBgCLE0UZ5NRGGrzQ14HSVS8HcDgH0X70w/edit?tab=t.d440c4doqxdr#bookmark=kix.x2zmvwn62x0k
default JGroups protocol stacks ship without the AUTH protocol, allowing any network-adjacent host to join the cluster, and the Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.
The root cause is CWE-502 (Deserialization of Untrusted Data) in the session replication marshalling path, combined with CWE-306 (Missing Authentication for Critical Function) on the JGroups cluster join interface. CVE-2016-2141 addressed AUTH bypass when AUTH was configured, but did not add AUTH to default stacks. CVE-2025-2251 addresses the same River unmarshaller deficiency in the EJB remote invocation path only — the fix commit (2656bb7) modified only ejb3/src/main/java/org/jboss/as/ejb3/subsystem/FilterSpecClassResolverFilter.java, leaving the Infinispan clustering marshaller completely unprotected.
Fix must add ClassResolverFilter to the SessionMarshallerFactory.JBOSS / JBossByteBufferMarshaller path in wildfly-clustering-web-extension
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15555?
The severity of CVE-2026-15555 is rated high with a score of 8.8.
How do I fix CVE-2026-15555?
To fix CVE-2026-15555, ensure that you apply the latest security patches provided by JBoss and restrict the usage of unfiltered deserialization.
What is CVE-2026-15555?
CVE-2026-15555 is a vulnerability in JBoss marshalling that allows remote code execution via deserialization of replicated session data.
Who is affected by CVE-2026-15555?
CVE-2026-15555 affects all deployments of JBoss using the Infinispan session replication without class filtering.
Why is CVE-2026-15555 considered a remote code execution vulnerability?
CVE-2026-15555 is considered a remote code execution vulnerability because it allows attackers to execute arbitrary code on cluster nodes by exploiting unfiltered deserialization.