CVE-2026-15555 — Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class fi…
Published: 2026-08-11 · CVSS: 8.8 · CVSS 3.1
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7