CVE-2026-15554
the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.
- Score
- CVSS 3.1 7.4 High
- Status
- Awaiting Analysis - secalert@redhat.com
- Published
- 2026-08-11
- Last modified
- 2026-10-20
- Weaknesses
- CWE-295
Affected products
- Jboss Enterprise Application Platform (Redhat)
- Jboss Enterprise Application Platform Els (Redhat)
- Jbosseapxp (Redhat)
References
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:53645
- https://access.redhat.com/errata/RHSA-2026:53646
- https://access.redhat.com/errata/RHSA-2026:53806
- https://access.redhat.com/errata/RHSA-2026:70228
- https://access.redhat.com/errata/RHSA-2026:70229
- https://access.redhat.com/errata/RHSA-2026:70230
- https://access.redhat.com/errata/RHSA-2026:70277
- https://access.redhat.com/security/cve/CVE-2026-15554
- https://bugzilla.redhat.com/show_bug.cgi?id=2480601
