Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 8.1, published 4 March 2025.

Which products and versions are affected?

org.wildfly.core:wildfly-elytron-integration (Maven) <= 27.0.0.Final; Red Hat WildFly Core <= 27.0.0.Final.

Is there a fix for This vulnerability?

A patch was published on 2026-05-18: Red Hat released security updates (RHSA-2026:18054, RHSA-2026:18055, RHSA-2026:18059) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run org.wildfly.core:wildfly-elytron-integration (Maven) or Red Hat WildFly Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Red Hat Wildfly Elytron improper authentication restriction in CLI

Q: Is there a fix for This vulnerability?

A patch was published on 2026-05-18: Red Hat released security updates (RHSA-2026:18054, RHSA-2026:18055, RHSA-2026:18059) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run org.wildfly.core:wildfly-elytron-integration (Maven) or Red Hat WildFly Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: high · CVSS 8.1 · Published 2025-03-04

A security flaw in the Wildfly Elytron integration component allows attackers to perform brute-force password guessing attacks against the Command Line Interface (CLI). The software fails to limit the number of failed login attempts, which could allow an unauthorized user to eventually gain administrative access to the application server. This could lead to full system compromise, data theft, or service disruption.

Technologies: Red Hat WildFly Core. Vendors: Maven, Red Hat.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 8.1, published 4 March 2025.
Which products and versions are affected?: org.wildfly.core:wildfly-elytron-integration (Maven) <= 27.0.0.Final; Red Hat WildFly Core <= 27.0.0.Final.
Is there a fix for This vulnerability?: A patch was published on 2026-05-18: Red Hat released security updates (RHSA-2026:18054, RHSA-2026:18055, RHSA-2026:18059) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run org.wildfly.core:wildfly-elytron-integration (Maven) or Red Hat WildFly Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts) exists in the Wildfly Elytron integration component. The root cause is a failure to implement rate-limiting or account lockout mechanisms for authentication attempts made via the Command Line Interface (CLI). An unauthenticated remote attacker can exploit this by sending a high volume of authentication requests over HTTP or SASL-exposed ports. While the attack complexity is rated high (likely due to the need for specific network access or configuration), a successful exploit allows for credential discovery and subsequent full unauthorized access to the management interface. The issue has been addressed in Red Hat JBoss EAP 8.1.6 and related updates.

Affected products

Red Hat Wildfly Core (wildfly-elytron-integration) <= 27.0.0.Final
Red Hat JBoss Enterprise Application Platform (EAP) 7.0.0, 8.0.0

Timeline

2025-01-14: other: Bug reported to Red Hat Bugzilla
2025-03-04: disclosed: Initial advisory publication
2026-02-13: other: Advisory withdrawn as duplicate of GHSA-qhp6-6p8p-2rqh
2026-05-18: patched: Red Hat released security updates (RHSA-2026:18054, RHSA-2026:18055, RHSA-2026:18059)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.