CVE-2026-85634: WildFly Privilege Escalation Vulnerability

CVE-2026-85634 Overview

CVE-2026-85634 is a path traversal vulnerability [CWE-22] in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library. This library underpins deployment management in WildFly and Red Hat JBoss Enterprise Application Platform (EAP). The function processes deployment names without proper sanitization and lacks a containment check against the restricted deployment directory. An authenticated attacker holding the Deployer role-based access control (RBAC) role can supply path traversal sequences in a deployment name. The attacker can then delete arbitrary directories or write files with attacker-controlled content outside the deployment root, escalating privileges to the management SuperUser role.

Critical Impact
A low-privileged Deployer account can escalate to full management SuperUser privileges on the application server, resulting in complete compromise of hosted applications and server configuration.

Affected Products

Red Hat JBoss Enterprise Application Platform (EAP)
WildFly application server
wildfly-core library (deployment subsystem)

Discovery Timeline

2026-10-15 - CVE-2026-85634 published to the National Vulnerability Database (NVD)
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-85634

Vulnerability Analysis

The flaw resides in ContentRepositoryImpl.copyExplodedContent, a routine responsible for materializing exploded deployment content into the server's managed content repository. The function accepts a deployment name supplied by the caller and uses it to construct a destination path on disk. Because the name is treated as trusted input, path traversal sequences such as ../ are preserved during path construction.

The implementation does not verify that the final resolved path remains contained within the designated deployment directory. This missing containment check converts a routine deployment operation into an arbitrary filesystem write and delete primitive. An attacker reaches the vulnerable code path through the standard management API, which only requires the Deployer RBAC role.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. User-supplied deployment names flow directly into filesystem operations without canonicalization or boundary enforcement. Any caller authorized to invoke deployment APIs can therefore influence paths outside the intended content root.

Attack Vector

Exploitation requires network access to the WildFly or JBoss EAP management interface and valid credentials for an account with the Deployer role. The attacker submits a deployment operation with a crafted name containing path traversal sequences. The server then deletes directories or writes files at attacker-chosen locations. By overwriting configuration or script files consumed by the SuperUser context, the attacker escalates privileges and obtains full administrative control. See the Red Hat CVE-2026-85634 Advisory and Red Hat Bug Report #2528476 for additional technical context.

Detection Methods for CVE-2026-85634

Indicators of Compromise

Deployment operation audit entries whose deployment name contains ../, ..\, URL-encoded traversal sequences, or absolute paths.
Unexpected files written or directories removed outside the standard WildFly or JBoss EAP deployment directory, such as under standalone/configuration or bin.
Promotion of a Deployer account to SuperUser or newly created management users not provisioned through normal change management.

Detection Strategies

Enable and review the WildFly management audit log for deploy, full-replace-deployment, and related operations invoked by Deployer-role accounts.
Alert on filesystem modifications to WildFly or JBoss EAP installation subdirectories performed by the application server process.
Correlate RBAC role changes in mgmt-users.properties and mgmt-groups.properties with recent deployment activity.

Monitoring Recommendations

Forward WildFly management audit logs and OS-level file integrity events to a centralized analytics platform for correlation.
Baseline normal deployment names and alert on deviations containing path separators or traversal tokens.
Monitor for new administrative sessions originating shortly after suspicious deployment operations.

How to Mitigate CVE-2026-85634

Immediate Actions Required

Apply the fixed wildfly-core version shipped by Red Hat for JBoss EAP and the corresponding WildFly release as referenced in the Red Hat CVE-2026-85634 Advisory.
Audit all accounts holding the Deployer RBAC role and remove assignments that are not strictly required.
Restrict network exposure of the management interface to trusted administrative networks only.

Patch Information

Red Hat tracks remediation under the advisory for CVE-2026-85634. Consult the vendor advisory and bug report for fixed component versions and errata applicable to each supported JBoss EAP release.

Workarounds

If immediate patching is not possible, revoke the Deployer role from non-administrative users and require SuperUser approval for deployment operations.
Place the management interface behind an authenticated reverse proxy or VPN and enforce source IP allowlisting.
Enable management audit logging and file integrity monitoring on the WildFly or JBoss EAP installation directory to detect exploitation attempts.

bash

# Example: restrict management interface to loopback in standalone.xml
# <interface name="management">
#   <inet-address value="${jboss.bind.address.management:127.0.0.1}"/>
# </interface>

# Remove Deployer role assignment via jboss-cli
/core-service=management/access=authorization/role-mapping=Deployer/include=user-USERNAME:remove()