CVE-2010-0738: JBoss JMX-Console access control bypass via non-GET/POST HTTP methods

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw is an unauthenticated network-reachable access control bypass listed in CISA KEV with documented ransomware use and a very high EPSS score.

What it is

The JMX-Console web application in Red Hat JBoss EAP 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 enforces access control only for GET and POST requests. Requests using any other HTTP method reach the GET handler without the intended authorization check, allowing unauthenticated access to JMX-Console functionality.

Impact

An attacker gains unauthenticated access to the JMX-Console, which can expose management operations and enable further compromise of the JBoss instance. The CVSS vector indicates limited integrity impact only, with no confidentiality or availability impact recorded.

Attack surface

Reachable over the network against the JMX-Console web application; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The flaw is triggered by sending a request with an HTTP method other than GET or POST.

Exploitation

CVE-2010-0738 is listed in CISA KEV with known ransomware campaign use, and EPSS shows a 30-day probability of 0.79415 (99.582 percentile). A reference is tagged Exploit, indicating public exploit material exists.

What to do

• Apply the vendor updates referenced in the Red Hat errata (RHSA-2010-0376 through RHSA-2010-0379) to move to JBoss EAP 4.2.0.CP09 or 4.3.0.CP08 or later.
• If patching is not immediately possible, restrict network access to the JMX-Console so it is not reachable from untrusted networks.
• Disable or remove the JMX-Console web application where it is not operationally required.
• Enforce authentication and authorization at a reverse proxy or web server layer that normalizes and validates HTTP methods before requests reach JBoss.

Detection

• Inspect web server and JBoss access logs for requests to JMX-Console paths using HTTP methods other than GET or POST (for example PUT, DELETE, HEAD, OPTIONS, TRACE).
• Alert on any unauthenticated access to JMX-Console endpoints, since legitimate administrative use should be authenticated.
• Monitor for anomalous or unexpected HTTP method usage across the JBoss application server generally.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.