CVE-2026-15555 is a deserialization vulnerability in the JBoss marshalling component used by the Infinispan session replication path. The vulnerability arises because the JBoss Marshalling River unmarshaller deserializes replicated session data without applying any class filtering, enabling attackers to exploit deserialization gadget chains to achieve remote code execution on every cluster node. The vulnerability is tracked as CWE-502 (Deserialization of Untrusted Data) and has a CVSS v3.1 base score of 8.8 (high severity) with attack vector from adjacent network, no privileges required, and no user interaction. Red Hat has released a security update for JBoss Enterprise Application Platform 7.4.25 that addresses this issue.

Successful exploitation allows an attacker to execute arbitrary code remotely on cluster nodes by sending specially crafted serialized session data. This compromises confidentiality, integrity, and availability of the affected systems, potentially leading to full system compromise. The vulnerability affects the session replication mechanism, which is critical for clustered environments.

Red Hat has released an official security update for JBoss Enterprise Application Platform 7.4.25 that fixes this vulnerability. Users should apply this update promptly. Prior to updating, ensure all previously released errata are applied and back up existing installations. No additional mitigations are specified by the vendor. Patch status is confirmed as fixed in version 7.4.25.