CVE-2026-15555
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In JBoss marshalling, the Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering, enabling RCE via deserialization gadget chains on every cluster node.
Risk Assessment
Risk of remote code execution on all cluster nodes, potentially leading to full system compromise and data breach.
Recommendation
Apply vendor patches to add class filtering in the unmarshaller and restrict network access to replication ports.
Original NVD description (English source)
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.