Remote Code Execution in JBoss Marshalling via Infinispan

A critical vulnerability (CVE-2026-15555) has been identified in JBoss Marshalling, specifically affecting the Infinispan session replication mechanism. The flaw exists because the Infinispan session replication path utilizes the JBoss Marshalling River unmarshaller to process replicated session data without implementing any class filtering. This architectural oversight allows an attacker capable of injecting malicious serialized session data into the replication stream to trigger deserialization gadget chains. Successful exploitation results in remote code execution (RCE) on all nodes participating in the affected cluster. Given the nature of session replication, this vulnerability poses a significant risk to distributed Java applications, as exploitation of a single cluster node can propagate to all other nodes. Defenders should prioritize auditing applications that use JBoss Marshalling or Infinispan, focusing on network traffic monitoring between cluster nodes and the application of vendor-supplied patches.

Impact

Successful exploitation allows for unauthenticated remote code execution on all cluster nodes, potentially leading to full system compromise, data exfiltration, and lateral movement within the environment. Affected sectors include any enterprise environment utilizing JBoss or Infinispan for session state management.

Recommendation

• Apply the security updates provided by Red Hat to remediate CVE-2026-15555 across all infrastructure.
• Audit network communication between Infinispan cluster nodes for anomalous serializable object traffic.
• Review application configurations to ensure strict class filtering is enforced during deserialization, if currently configured to use JBoss Marshalling.