Wildfly's IIOP listener may allow deserialization of input streams before authentication, potentially enabling an attacker with access to the IIOP port to send malicious objects. Exploitation requires that the target EJB accepts untyped method parameters and that suitable gadget chains exist on the classpath. By default, the IIOP service binds to localhost, limiting remote exploitation. Red Hat rates this vulnerability as Moderate due to these constraints. Mitigations include restricting network access to the IIOP listener or removing the IIOP subsystem if not needed.