CVE-2026-15561: Red Hat JBoss Enterprise Application Platform 7.4.25 (exact versions not specified); +9 more affected products

Affected technology

Red Hat JBoss Enterprise Application Platform 7.4.25 · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform 8.1 · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform 7 · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform Expansion Pack · Exact affected versions not specified by the source
Red Hat

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker can use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service. Vendor/CNA’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and integrity impact as none; availability impact as high.