This vulnerability arises from the JBoss Marshalling component used in Red Hat JBoss Enterprise Application Platform 7, specifically in the Infinispan session replication mechanism. The deserialization process uses the JBoss Marshalling River unmarshaller without any class filtering, which permits attackers to craft malicious serialized data that, when deserialized, can trigger remote code execution (RCE) through gadget chains on every cluster node. The vulnerability is tracked as CVE-2026-15555 with a CVSS v3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability. The vendor advisory confirms the issue but does not currently provide a remediation or patch status.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code remotely on cluster nodes by sending specially crafted serialized session data. This can lead to full system compromise, including unauthorized data access, modification, and denial of service. The vulnerability affects the confidentiality, integrity, and availability of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor Red Hat's advisory page for updates. No vendor-provided mitigations or workarounds are currently documented. Avoid exposing the Infinispan session replication service to untrusted networks to reduce risk.