CVE-2026-15555: JBoss Marshalling RCE Vulnerability

CVE-2026-15555 Overview

A flaw in JBoss Marshalling allows remote code execution across clustered application nodes. The Infinispan session replication path deserializes replicated session data using the JBoss Marshalling River unmarshaller without any class filtering. Attackers with access to the cluster's replication traffic can inject crafted serialized payloads that trigger deserialization gadget chains. Successful exploitation grants code execution on every node participating in the cluster.

The vulnerability is tracked as CWE-502: Deserialization of Untrusted Data and affects environments relying on JBoss Marshalling for Infinispan-backed session replication.

Critical Impact
Unfiltered deserialization on the session replication channel enables adjacent-network attackers to execute arbitrary code on every clustered node, compromising confidentiality, integrity, and availability.

Affected Products

Red Hat products distributing vulnerable JBoss Marshalling (see Red Hat CVE Analysis CVE-2026-15555)
Applications using Infinispan session replication with the JBoss Marshalling River unmarshaller
Clustered JBoss/WildFly deployments referenced in RHSA-2026:53644 and RHSA-2026:53806

Discovery Timeline

2026-08-11 - CVE-2026-15555 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-15555

Vulnerability Analysis

The vulnerability stems from the Infinispan session replication path invoking the JBoss Marshalling River unmarshaller without configuring a class filter. When a cluster node receives replicated session state from a peer, it deserializes the payload directly into Java objects. Any class present on the classpath can be instantiated during the deserialization process.

Attackers who can place messages on the replication channel supply a serialized graph that chains benign classes into a gadget chain. The unmarshaller reconstructs the graph and invokes methods such as readObject, readResolve, and property setters during the process. This behavior triggers arbitrary code execution in the JVM hosting the Infinispan cache.

Because session state propagates to every cluster member, a single injected payload compromises the entire cluster. The flaw does not require authentication and does not require user interaction.

Root Cause

The root cause is the absence of a ClassResolver or ClassFilter on the River unmarshaller used by the session replication code path. JBoss Marshalling supports allow-list filtering, but the Infinispan integration did not enable it. All classes reachable from the deployment's classpath become candidate gadgets.

Attack Vector

Exploitation requires access to the adjacent network segment carrying JGroups replication traffic. An attacker who joins the cluster, spoofs a member, or otherwise injects frames into the replication multicast or TCP transport can deliver the malicious payload. The receiving node deserializes the frame during normal session replication processing, executing the embedded gadget chain without additional interaction.

No verified public exploit code exists for this vulnerability. Technical details are described in the Red Hat Bug Report #2480637.

Detection Methods for CVE-2026-15555

Indicators of Compromise

Unexpected child processes spawned by the JBoss/WildFly JVM, particularly shells, scripting interpreters, or download utilities
JGroups replication messages originating from IP addresses outside the documented cluster member list
ClassNotFoundException, InvalidClassException, or StreamCorruptedException entries in server logs referencing the River unmarshaller
Outbound network connections from application server nodes to previously unseen destinations shortly after replication events

Detection Strategies

Monitor process ancestry on cluster nodes for JVM processes spawning sh, bash, cmd.exe, powershell.exe, curl, or wget
Inspect JGroups transport logs for peers that do not match the authorized cluster membership
Alert on deserialization exception patterns in server logs, which often accompany failed gadget-chain attempts

Monitoring Recommendations

Capture and retain JGroups and Infinispan cluster telemetry for post-incident analysis
Baseline outbound connections from application server nodes and alert on deviations
Track JVM memory and CPU anomalies that correlate with replication traffic bursts

How to Mitigate CVE-2026-15555

Immediate Actions Required

Apply the vendor updates published in RHSA-2026:53644 and RHSA-2026:53806
Restrict the JGroups replication network to authenticated cluster members only
Enable encryption and authentication on the JGroups transport stack (AUTH and ASYM_ENCRYPT or SYM_ENCRYPT protocols)
Audit application classpaths for known deserialization gadget libraries and remove unused dependencies

Patch Information

Red Hat has released fixed packages through RHSA-2026:53644 and RHSA-2026:53806. The fix introduces class filtering on the JBoss Marshalling River unmarshaller used in the Infinispan session replication path. Refer to the Red Hat CVE Analysis CVE-2026-15555 for product-specific guidance and affected package versions.

Workarounds

Isolate cluster replication traffic on a dedicated VLAN with strict access control lists
Configure a JBoss Marshalling ClassResolver or allow-list ClassFilter restricting deserialization to expected session classes
Disable Infinispan session replication where high availability is not required, favoring sticky sessions or an external session store
Enforce mutual TLS between cluster members to prevent unauthorized nodes from joining

bash

# Configuration example
# Reference only - consult Red Hat advisories for authoritative guidance
# Enable JGroups authentication and encryption in standalone-ha.xml
#   <protocol type="ASYM_ENCRYPT">
#     <property name="encrypt_entire_message">true</property>
#   </protocol>
#   <protocol type="AUTH">
#     <property name="auth_class">org.jgroups.auth.MD5Token</property>
#   </protocol>