wildfly-iiop-openjdk vulnerabilities
CVEs whose affected-version data names the wildfly-iiop-openjdk package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-15564High· 7.4Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization
Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if …
▾ TwilightRed Hat · wildfly-ejb3EPSS 0.12%via CVEORG
CVE-2026-114488High· 7.4Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding
A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level auth…
▾ TwilightRed Hat · wildfly-iiop-openjdkEPSS 0.34%via CVEORG