CVE-2026-15555

Name of the Vulnerable Software and Affected Versions JBoss marshalling (affected versions not specified)

Description A flaw exists in the Infinispan session replication path where replicated session data is deserialized using the JBoss Marshalling River unmarshaller without class filtering. This allows remote code execution (RCE) on every cluster node through the use of deserialization gadget chains. Deserialization is the process of converting a stream of bytes back into an object, and gadget chains are sequences of existing code fragments that can be leveraged to execute unintended commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.