CVE-2025-2251: WildFly and JBoss EAP RCE Vulnerability

CVE-2025-2251 Overview

CVE-2025-2251 is an insecure deserialization vulnerability [CWE-502] affecting WildFly and Red Hat JBoss Enterprise Application Platform (EAP). The flaw resides in the Enterprise JavaBeans (EJB) remote invocation mechanism, where JBoss Marshalling processes untrusted serialized data. An attacker who successfully delivers a crafted serialized object to the EJB endpoint can trigger remote code execution on the application server. Red Hat published multiple security advisories to address the vulnerability across supported product streams. The issue was resolved in WildFly 36.0.0.Final.

Critical Impact
Successful exploitation leads to remote code execution on the WildFly or JBoss EAP host, allowing an attacker to compromise application data, hosted services, and the underlying operating system.

Affected Products

Red Hat JBoss Enterprise Application Platform (EAP)
WildFly application server (versions prior to 36.0.0.Final)
Applications relying on JBoss Marshalling for EJB remote invocation

Discovery Timeline

2025-04-07 - CVE-2025-2251 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2025-2251

Vulnerability Analysis

The vulnerability originates in the EJB remote invocation path used by WildFly and JBoss EAP. When a remote client invokes an EJB, the server uses JBoss Marshalling to deserialize the invocation payload. The deserialization routine does not sufficiently restrict which classes are reconstructed from the incoming byte stream. An attacker who can reach the EJB endpoint over the network can submit a crafted serialized object graph that instantiates gadget classes present on the server classpath. Chained gadgets ultimately execute attacker-controlled logic inside the JVM running the application server.

The EPSS probability for this vulnerability is approximately 0.974%, indicating measurable interest in exploitation attempts across the internet. Exploitation requires network reachability to the EJB remote port and a suitable gadget chain in the deployed application dependencies.

Root Cause

The root cause is untrusted data deserialization in the JBoss Marshalling component invoked during EJB remote calls. The deserializer accepts arbitrary Java classes from the wire without a strict allow-list, violating the safe-deserialization principles described in [CWE-502]. When gadget classes are available on the classpath, reconstruction of the malicious object graph triggers side effects that lead to arbitrary code execution.

Attack Vector

The attack vector is network-based against the EJB remote invocation listener. An attacker crafts a malicious serialized payload, transmits it as an EJB invocation, and relies on the server-side unmarshalling process to execute the gadget chain. No authentication step is required by the deserialization routine itself, though CVSS metrics reflect scenarios where reaching the invocation surface may involve environmental preconditions. See the Red Hat CVE Analysis for CVE-2025-2251 and the WildFly Pull Request #18872 for technical details on the fix.

No verified public proof-of-concept code was available at the time of writing. Refer to the linked Red Hat advisories for authoritative technical details.

Detection Methods for CVE-2025-2251

Indicators of Compromise

Unexpected child processes spawned by the WildFly or JBoss EAP Java process, such as sh, bash, cmd.exe, or powershell.exe.
Outbound network connections initiated by the application server to unknown external hosts shortly after inbound EJB traffic.
Errors or stack traces in server.log referencing org.jboss.marshalling and readObject during deserialization of remote invocations.

Detection Strategies

Monitor EJB remote invocation ports (default 8080, 8443, or configured Remoting ports) for anomalous binary payloads and unusual client sources.
Enable Java Flight Recorder or application-level auditing to log classes resolved during unmarshalling and alert on gadget-related classes such as those from commons-collections, commons-beanutils, or Spring.
Correlate application server process telemetry with subsequent file writes to deployment or temporary directories.

Monitoring Recommendations

Ingest WildFly and JBoss EAP logs into a centralized analytics platform and build detections for repeated MarshallingException or class-not-found events tied to EJB endpoints.
Baseline normal EJB client identities and alert on invocations from unexpected network segments, especially from internet-facing zones.
Track patch state for WildFly and JBoss EAP hosts to identify systems still exposed to CVE-2025-2251.

How to Mitigate CVE-2025-2251

Immediate Actions Required

Inventory all WildFly and JBoss EAP instances and identify versions exposing EJB remote invocation.
Apply the vendor updates referenced in Red Hat advisories RHSA-2025:10452, RHSA-2025:10453, RHSA-2025:10459, RHSA-2025:10924, RHSA-2025:10925, RHSA-2025:10926, and RHSA-2025:10931.
Restrict network access to EJB remoting ports so that only trusted application clients can reach them.

Patch Information

Red Hat has published fixed builds for JBoss EAP through the advisories listed above. Upstream WildFly users should upgrade to WildFly 36.0.0.Final, which includes the fix delivered in Pull Request #18872 and tracked in WFLY-20550. Additional context is available in Red Hat Bug Report #2351678.

Workarounds

Disable EJB remote invocation subsystems on servers that do not require them.
Place EJB endpoints behind network segmentation, VPN, or mutual TLS so untrusted clients cannot submit serialized payloads.
Remove unnecessary libraries known to contain deserialization gadgets from application deployments to reduce exploitable chains.

bash

# Example: restrict EJB remoting port to trusted subnet using iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP