VULNERABILITY INTELLIGENCE
CVE-2025-2251
CVSS score6.2 MEDIUM
EPSS probability1.06%
CISA KEVNot currently listed
Published2025-04-07
Last modified2026-08-19
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H
Description
A security flaw exists in WildFly and JBoss Enterprise Application Platform (EAP) within the Enterprise JavaBeans (EJB) remote invocation mechanism. This vulnerability stems from untrusted data deserialization handled by JBoss Marshalling. This flaw allows an attacker to send a specially crafted serialized object, leading to remote code execution without requiring authentication.
Weakness classification
- secalert@redhat.com: CWE-502