Is CVE-2026-15564 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15564 being exploited in the wild.

How severe is CVE-2026-15564?

High severity, with a CVSS score of 7.4, published 29 October 2026.

How is CVE-2026-15564 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15564?

Check whether you run Red Hat WildFly. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15564: Wildfly IIOP listener pre-authentication deserialization

CVE-2026-15564 · Severity: high · CVSS 7.4 · Published 2026-10-29

Wildfly is a Java application server that provides CORBA/IIOP protocol support for remote application communication. An attacker with network access to the IIOP port (default 3528) can send malicious serialized objects that bypass authentication checks, potentially achieving code execution if the target application has vulnerable code patterns in its classpath. This risk is reduced in standard deployments where the IIOP service only listens on localhost.

Technologies: Red Hat WildFly. Vendors: Red Hat.

Quick answers

Is CVE-2026-15564 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15564 being exploited in the wild.
How severe is CVE-2026-15564?: High severity, with a CVSS score of 7.4, published 29 October 2026.
Which products and versions are affected?: Red Hat Wildfly.
Is there a fix for CVE-2026-15564?: No fixed version is recorded yet. Restrict network access to the IIOP listener (port 3528) using firewall rules to permit only localhost or authorized management networks. If CORBA/IIOP interoperability is not required, disable the IIOP subsystem via JBoss Management CLI using the command /subsystem=iiop-openjdk:remove.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-29"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15564 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15564?: Check whether you run Red Hat WildFly. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict network access to the IIOP listener (port 3528) using firewall rules to permit only localhost or authorized management networks. If CORBA/IIOP interoperability is not required, disable the IIOP subsystem via JBoss Management CLI using the command /subsystem=iiop-openjdk:remove.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-29"}]

Technical details

The IIOP listener in Wildfly deserializes input streams before performing authentication, creating a pre-auth deserialization vulnerability (CWE-829). Successful exploitation requires an exposed EJB with untyped method parameters and a viable gadget chain on the classpath; the vulnerability is triggered via network access to the IIOP port. Red Hat rates this as moderate because in standard configurations, the IIOP service binds only to localhost, restricting remote reachability.

Affected products

Red Hat Wildfly

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.