The Undertow AJP listener in Red Hat JBoss Enterprise Application Platform 7 improperly validates ssl_cert and is_ssl attributes, accepting forged values without shared-secret authentication. This flaw enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol. The vulnerability is classified under CWE-295 (Improper Certificate Validation) and has a CVSS v3.1 base score of 7.4, indicating high impact on confidentiality and integrity. Red Hat's advisory confirms the issue but does not yet specify a remediation level or patch availability.

An attacker with network access to TCP port 8009 can bypass CLIENT-CERT authentication by injecting a forged certificate, potentially gaining unauthorized access and impersonating trusted clients. This compromises confidentiality and integrity of the affected system. There is no indication of impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15554 for current remediation guidance. Until a fix is available, restrict network access to port 8009 to trusted hosts only to reduce exposure. Monitor Red Hat communications for updates on patches or official mitigations.