CVE-2017-12149: JBoss HTTP Invoker deserialization allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, CISA KEV listing with known ransomware use, and EPSS above 0.90 make this an urgent, actively exploited remote code execution flaw.

What it is

The ReadOnlyAccessFilter doFilter method in the JBoss HTTP Invoker deserializes untrusted data without restricting which classes can be loaded. An unauthenticated remote attacker can send crafted serialized data to trigger arbitrary code execution on the server. The flaw affects JBoss Application Server as shipped with Red Hat Enterprise Application Platform 5.2.

Impact

An attacker gains remote code execution with the privileges of the JBoss process, enabling full compromise of the application server and any data or services it can reach. CISA KEV notes known ransomware campaign use, so impact can extend to enterprise-wide encryption and extortion.

Attack surface

Reachable over the network through the HTTP Invoker endpoint; the CVSS vector shows no privileges or user interaction required (AV:N/AC:L/PR:N/UI:N). Any host exposing the vulnerable JBoss HTTP Invoker is a candidate.

Exploitation

Listed in CISA KEV since 2021-12-10 with known ransomware campaign use, and EPSS 30-day probability is 0.90713 (99.8th percentile), indicating active and highly likely exploitation. Public exploit code is referenced via a GitHub Exploits repository.

What to do

• Apply the Red Hat errata fixes (RHSA-2018:1607, RHSA-2018:1608) or upgrade to a supported JBoss EAP release.
• If patching cannot be done immediately, remove or disable the HTTP Invoker endpoint and block external access to it.
• Restrict network access to JBoss management and invoker ports to trusted hosts only.
• Monitor for and remove any web shells or unexpected files/processes left by prior exploitation.
• Treat any internet-exposed JBoss EAP 5.2 instance as compromised until proven otherwise and rotate credentials.

Detection

• Inspect JBoss HTTP Invoker access logs for POST requests with serialized Java payloads or unusual content types.
• Alert on java deserialization gadget class names (e.g., CommonsCollections, ysoserial markers) in request bodies or process command lines.
• Monitor for child processes spawned by the JBoss Java process, especially shells or download utilities.
• Hunt for new JSP files, web shells, or unexpected outbound connections from JBoss hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.