CVE-2026-15563 Overview
CVE-2026-15563 is a missing authentication vulnerability [CWE-306] in the Internet Inter-ORB Protocol (IIOP) subsystem of Red Hat JBoss Enterprise Application Platform (EAP). The IIOP listener's NameService accepts bind operations without authentication. An attacker on the network can hijack Java Naming and Directory Interface (JNDI) lookups by binding them to a malicious Object Request Broker (ORB). Successful exploitation enables man-in-the-middle (MITM) interception or denial of service on subsequent JNDI invocations. Red Hat has published security advisories and released updated packages addressing the flaw.
Critical Impact
Unauthenticated attackers reachable over IIOP can hijack JNDI bindings, intercept application traffic, and disrupt naming lookups.
Affected Products
- Red Hat JBoss Enterprise Application Platform (EAP) — see Red Hat advisories for exact affected versions
- Deployments exposing the IIOP NameService listener on the network
- Applications performing JNDI lookups through the affected ORB
Discovery Timeline
- 2026-08-11 - CVE-2026-15563 published to the National Vulnerability Database (NVD)
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-15563
Vulnerability Analysis
The flaw resides in the IIOP subsystem of JBoss EAP. IIOP is the CORBA transport protocol that enables remote object invocation between distributed Java components. JBoss EAP exposes a CORBA NameService through its IIOP listener to support JNDI lookups over IIOP.
The listener accepts bind operations without validating the caller's identity. An attacker who can reach the IIOP port can register arbitrary name-to-object bindings, including references pointing to an attacker-controlled ORB. Applications that later resolve those names through JNDI receive the attacker's object reference instead of the legitimate service.
This primitive supports two outcomes. First, the attacker sits between the client and the real service, observing or altering method invocations (MITM). Second, the attacker binds a non-functional reference, causing lookups and downstream invocations to fail (denial of service on invocation).
Root Cause
The root cause is missing authentication on a security-sensitive operation [CWE-306]. The NameService bind path does not require the caller to authenticate, so trust decisions rely solely on network reachability to the IIOP listener.
Attack Vector
The attack vector is network-based and does not require authentication or user interaction. The attacker must be able to reach the IIOP port exposed by the EAP instance and must time or coordinate the malicious bind so that legitimate JNDI consumers resolve the hijacked name. Consult the Red Hat CVE page for CVE-2026-15563 and Red Hat Bug Report #2483138 for additional technical context.
No verified public proof-of-concept code is available. The vulnerability is described in prose based on the vendor advisory and CWE classification.
Detection Methods for CVE-2026-15563
Indicators of Compromise
- Unexpected bind or rebind operations against the CORBA NameService from unknown source addresses.
- JNDI lookups resolving to ORB endpoints outside the documented service inventory.
- Application errors or exceptions in EAP server logs referencing IIOP name resolution failures or unexpected object references.
- New or unexplained TCP sessions to the EAP IIOP listener port from hosts that are not registered CORBA clients.
Detection Strategies
- Inventory all EAP instances with the IIOP subsystem enabled and confirm which ones expose the NameService on reachable networks.
- Compare current JNDI name-to-object bindings against a known-good baseline and alert on additions or modifications.
- Enable audit logging for the IIOP subsystem and forward events to a centralized analytics platform for correlation.
Monitoring Recommendations
- Monitor network flows to EAP IIOP listener ports and alert on connections from unauthorized sources.
- Track process and network telemetry from JBoss EAP hosts for outbound connections to unexpected ORB endpoints after JNDI lookups.
- Review authentication and configuration change events on EAP servers following any patch or configuration update.
How to Mitigate CVE-2026-15563
Immediate Actions Required
- Apply the Red Hat updates referenced in RHSA-2026:53644 and RHSA-2026:53806 to affected JBoss EAP deployments.
- Restrict network access to the IIOP listener using host firewalls, network ACLs, or segmentation so only trusted CORBA clients can reach it.
- Audit existing JNDI bindings and remove any entries that cannot be attributed to a legitimate application.
Patch Information
Red Hat has released fixed packages through RHSA-2026:53644 and RHSA-2026:53806. Refer to the Red Hat CVE page for CVE-2026-15563 for the authoritative list of affected components, fixed versions, and remediation guidance.
Workarounds
- Disable the IIOP subsystem in JBoss EAP if applications do not require CORBA or IIOP-based JNDI access.
- Require authenticated IIOP connections and enable transport-level protections such as CSIv2 and TLS where the deployment supports them.
- Place the EAP IIOP listener behind a network boundary that rejects traffic from untrusted sources until patches are applied.
# Example: disable the IIOP OpenJDK subsystem via the JBoss CLI
/subsystem=iiop-openjdk:remove
reload
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
