CVE-2026-15563 describes a security flaw in the IIOP NameService listener of Red Hat JBoss Enterprise Application Platform (EAP) 7. The NameService accepts bind operations without requiring authentication, which allows an attacker to hijack Java Naming and Directory Interface (JNDI) lookups by redirecting them to a malicious Object Request Broker (ORB). This can lead to man-in-the-middle attacks or denial of service conditions on further invocations. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function) and has a CVSS v3.1 base score of 7.4 (High severity) with network attack vector, high attack complexity, no privileges required, and no user interaction needed. Red Hat has released a security update for JBoss EAP 7.4.25 addressing this issue, and users are advised to apply this update.

Exploitation of this vulnerability allows an unauthenticated attacker to hijack JNDI lookups by binding them to a malicious ORB, enabling man-in-the-middle attacks or denial of service on affected systems. This compromises confidentiality and integrity of the affected service. Availability is not impacted. The attacker gains the ability to intercept or disrupt communications that rely on the vulnerable NameService component.

Red Hat has released an official security update for JBoss Enterprise Application Platform 7.4.25 that fixes this vulnerability. Users should apply this update to remediate the issue. Prior to updating, ensure all previously released errata are applied and back up existing installations. No alternative mitigations are specified by the vendor advisory. Patch status is confirmed as fixed in version 7.4.25.