CVE-2015-7501: Red Hat JBoss Java deserialization allows remote command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required and an EPSS score above the 99th percentile make this a top-priority exposure despite the absence of KEV listing.

What it is

Multiple Red Hat JBoss products deserialize untrusted Java objects and, through the Apache Commons Collections library, allow remote attackers to execute arbitrary commands. The flaw affects a wide range of JBoss middleware and platform components, so any exposed service that accepts serialized Java data is at risk.

Impact

An unauthenticated remote attacker can execute arbitrary commands on the affected server, leading to full compromise of the host and any data or credentials it holds.

Attack surface

Reached over the network via crafted serialized Java objects sent to a vulnerable JBoss endpoint; the CVSS vector shows no privileges or user interaction required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.85562 (99.7th percentile), indicating very high predicted exploitation activity; references are vendor advisories and VDB entries with no exploit tags.

What to do

• Apply the Red Hat errata (RHSA-2015-2500 through RHSA-2016-1773) for each affected product.
• Upgrade or remove the vulnerable Apache Commons Collections library where the product permits.
• Restrict network access to JBoss management, messaging and remoting ports to trusted hosts only.
• Enable Java deserialization filtering or a serialization whitelist on any service that accepts serialized objects.
• Monitor vendor advisories for Oracle products that bundle the affected JBoss components.

Detection

• Alert on serialized Java object streams (hex AC ED 00 05) arriving at JBoss endpoints from unexpected sources.
• Monitor for child processes spawned by the JBoss Java process, especially shell or command interpreters.
• Watch for outbound connections from JBoss hosts to unusual destinations following inbound serialized payloads.
• Review JBoss application and access logs for anomalous deserialization requests or repeated connection attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.