Zero Radar
← feed
HighVulnerabilityCVE-2026-114488updated 29 Oct 2026, 14:17 UTC

WildFly: remote attackers can impersonate users on IIOP EJB calls

An attacker on the network can pretend to be any user when calling certain remote business components of the WildFly application server, without logging in. This can let them read or change data they should not reach.

Official, 3 sources
SeverityHighCVSS 7.4 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerNo login or credentials needed
  2. 2IIOP port 3528Sends forged identity in service context
  3. 3CSIv2 interceptorAccepts identity without transport check
  4. 4@Remote EJBRuns call as impersonated principal
  5. 5Data accessedReads or changes data unlawfully
  6. ResultAttacker acts as any user

What happened

WildFly's CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the IIOP service context without verifying transport-level authentication, allowing unauthenticated principal impersonation on IIOP-exposed @Remote EJBs via port 3528.

Why it is dangerous: An unauthenticated remote attacker can act as any principal on every IIOP-exposed @Remote EJB, bypassing security controls and potentially manipulating data; BSI rates it as medium severity.

Are you affected?

You are affected if you run WildFly with IIOP enabled and @Remote EJBs exposed on port 3528.

What to do

  1. Check whether your WildFly server exposes IIOP on port 3528 with @Remote EJBs; if it does, restrict access to that port with firewall rules to trusted hosts only.
  2. Check the vendor advisory (GitHub GHSA-998f-p8vh-hwg6, Red Hat) for a fixed WildFly version and update as soon as one is available.
  3. Monitor IIOP and EJB access logs for unexpected principal identities.

Timeline

  1. 29 Oct 2026, 06:17 UTC
    Publicly disclosed
  2. 29 Oct 2026, 06:17 UTC
    Reported by NVD · NVD
  3. 29 Oct 2026, 06:21 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 14:04 UTC
    CERT-Bund (BSI) reported on it · CERT-Bund (BSI)
  5. 29 Oct 2026, 14:17 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-114488 · GHSA-998f-p8vh-hwg6
CVSS
7.4 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
29 Oct 2026, 06:17 UTC
On Zero Radar
29 Oct 2026, 06:21 UTC (4 min after disclosure)
Last change
29 Oct 2026, 14:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

WildFly: remote attackers can impersonate users on IIOP EJB calls · Zero Radar