CVE Catalog
CVE-2026-15563
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk0.29%
21th percentile - higher than 21% of all known CVEs
Summary
In EAP IIOP, the NameService accepts bind operations without authentication, allowing an attacker to hijack JNDI lookups and bind them to a malicious ORB, achieving MITM or DoS on further invocations.
Risk Assessment
Risk of communication interception and disruption of services using JNDI, potentially leading to data leakage or system unavailability.
Recommendation
Enable authentication for bind operations in NameService and restrict access to IIOP ports to trusted clients only.
Original NVD description (English source)
A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.