CVE-2026-15563: Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos
A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.
Other sources
original reporting:
Missing Authentication — pre-auth CosNaming write ops on iiop-openjdk :3528 (JBoss EAP)
Missing authentication on the IIOP CosNaming service: the :3528 IIOP listener's NameService accepts bind/rebind/unbind operations without any authentication, allowing an unauthenticated attacker to hijack EJB JNDI lookups by rebinding stub references to an attacker-controlled ORB (MITM for all subsequent client invocations) or to unbind critical services for denial of service. findings/jboss-eap96.md
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15563?
The severity of CVE-2026-15563 is rated high with a score of 7.4.
What types of attacks are possible due to CVE-2026-15563?
Due to CVE-2026-15563, attackers can perform Man-in-the-Middle (MITM) or Denial of Service (DoS) attacks.
How can I mitigate the risks associated with CVE-2026-15563?
To mitigate the risks of CVE-2026-15563, ensure that authentication mechanisms are implemented for IIOP NameService operations.
What systems are affected by CVE-2026-15563?
CVE-2026-15563 affects EAP IIOP and Wildfly-iiop-openjdk systems.
What is the nature of the flaw in CVE-2026-15563?
The flaw in CVE-2026-15563 allows the IIOP NameService to accept bind operations without authentication, enabling potential exploitation by attackers.