Detections
Analytics
CVE-2026-15555
high
Description
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.
References
https://access.redhat.com/errata/RHSA-2026:70277
https://access.redhat.com/errata/RHSA-2026:70230
https://access.redhat.com/errata/RHSA-2026:70229
https://access.redhat.com/errata/RHSA-2026:70228
https://access.redhat.com/errata/RHSA-2026:53806
https://access.redhat.com/errata/RHSA-2026:53646