{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aredhatwildfly_core/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:redhat:wildfly_core:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-12977"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WildFly Core"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","webserver","wildfly"],"_cs_type":"advisory","_cs_vendors":["Red Hat"],"content_html":"\u003cp\u003eCVE-2026-12977 is a privilege escalation vulnerability within the deployment-operation family of WildFly Core. The flaw originates from improper sensitivity classification in specific handlers, such as upload-deployment-url. This oversight allows an authenticated user assigned to the restricted \u0026quot;Maintainer\u0026quot; role to access configuration files that should be protected. Successful exploitation can lead to the exfiltration of credentials stored within these configurations, subsequently enabling an attacker to escalate privileges to \u0026quot;SuperUser\u0026quot; (full administrative control) over the server.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker with valid \u0026quot;Maintainer\u0026quot; level credentials can read unauthorized configuration files, exfiltrate sensitive credential material, and perform a full privilege escalation to \u0026quot;SuperUser,\u0026quot; resulting in complete administrative control over the affected WildFly Core instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of WildFly Core within the environment and audit current user assignments to the \u0026quot;Maintainer\u0026quot; role.\u003c/li\u003e\n\u003cli\u003eReview vendor security bulletins from Red Hat for the release of a patched version of WildFly Core and apply updates across all production environments immediately upon availability.\u003c/li\u003e\n\u003cli\u003eMonitor administrative audit logs for unusual deployment operations, specifically those initiated by accounts with restricted or \u0026quot;Maintainer\u0026quot; level roles.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T19:56:31Z","date_published":"2026-11-09T19:56:31Z","id":"https://feed.craftedsignal.io/briefs/2026-11-wildfly-core-privesc/","summary":"An authentication-based privilege escalation vulnerability in WildFly Core allows a restricted Maintainer-level user to read sensitive configuration files and achieve SuperUser administrative control.","title":"WildFly Core: Improper sensitivity classification in deployment-operation (CVE-2026-12977)","url":"https://feed.craftedsignal.io/briefs/2026-11-wildfly-core-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:redhat:wildfly_core:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}