# CVE-2026-15562: Red Hat Enterprise Application Platform jboss-remoting denial of service

Source: https://junglewise.ai/threats/cve-2026-15562-red-hat-enterprise-application-platform-jboss-remoting-denial-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-15562 · Severity: high · CVSS 7.5 · Published 2026-08-11

Red Hat Enterprise Application Platform (EAP) is a Java-based application server used to run enterprise business applications. A flaw in its jboss-remoting component allows remote attackers to cause out-of-memory errors that degrade server performance and availability across all running requests, resulting in denial of service without requiring authentication.

Technologies: [Red Hat Enterprise Application Platform](https://junglewise.ai/threats/technologies/enterprise-application-platform). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-15562 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15562 being exploited in the wild.

**How severe is CVE-2026-15562?** High severity, with a CVSS score of 7.5, published 11 August 2026.

**Which products and versions are affected?** Red Hat Enterprise Application Platform <UNKNOWN>.

**Is there a fix for CVE-2026-15562?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15562 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-15562?** Check whether you run Red Hat Enterprise Application Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in EAP's jboss-remoting library and can be exploited via the Upgrade handshake mechanism on network ports 8080, 9990, or 4447. A remote unauthenticated attacker who can reach these ports can trigger out-of-memory (OOM) errors that impact the entire server, degrading or blocking legitimate requests. The attack requires network connectivity to the affected ports and completion of the jboss-remoting handshake. The flaw allows an attacker to conduct a denial-of-service attack without prior authentication or special privileges. Patches or updates are expected to be available from Red Hat.

## Affected products

- Red Hat Enterprise Application Platform <UNKNOWN>

## Timeline

- 2026-08-11: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/jbossnetwork/restricted/listSoftware.html](https://access.redhat.com/jbossnetwork/restricted/listSoftware.html)

## Related threats

- [Red Hat Enterprise Application Platform Artemis deserialization vulnerability](https://junglewise.ai/threats/cve-2026-86404-eap-s-artemis-deserialization-configuration-permits)
- [Red Hat EAP IIOP NameService authentication bypass](https://junglewise.ai/threats/cve-2026-15563-red-hat-eap-iiop-nameservice-authentication-bypass)
- [Red Hat Undertow HTTP/1.1 chunked-transfer decoder denial of service](https://junglewise.ai/threats/cve-2026-15561-red-hat-undertow-http-1-1-chunked-transfer-decoder-denial-of)