CVE-2026-15555 in Marshalling
Summary
by MITRE • 08/11/2026
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability resides within the JBoss Marshalling framework, specifically affecting the Infinispan session replication functionality that operates across cluster nodes. The flaw manifests when replicated session data is processed through the JBoss Marshalling River unmarshaller without any class filtering mechanisms in place. This architectural oversight creates a critical attack surface where maliciously crafted serialized data can be executed across all nodes within an Infinispan cluster environment.
The technical implementation of this vulnerability leverages deserialization gadget chains that exploit the lack of class validation during the unmarshalling process. When session data is replicated across cluster nodes, each node attempts to deserialize the received data using the River unmarshaller which accepts any class without prior verification. This absence of class filtering represents a fundamental security gap that aligns with CWE-502, which addresses deserialization of untrusted data as a primary vector for remote code execution attacks. The vulnerability operates at the core of Java serialization mechanisms and demonstrates how improper handling of serialized objects can lead to complete system compromise.
The operational impact of this vulnerability extends beyond individual node compromise to affect entire cluster environments where Infinispan session replication is enabled. Attackers can craft malicious session data that, when replicated across multiple nodes, triggers remote code execution on every affected cluster member. This creates a cascading effect where a single successful exploitation can lead to complete cluster takeover, potentially resulting in data breaches, service disruption, and unauthorized access to sensitive information. The attack vector is particularly dangerous because it requires no authentication or privileged access on the target system, making it an ideal candidate for automated exploitation.
Mitigation strategies must address both the immediate vulnerability and broader architectural security concerns. Organizations should implement strict class filtering policies within the JBoss Marshalling framework, ensuring that only trusted classes are permitted during deserialization processes. The recommended approach includes configuring class white-lists or black-lists within the River unmarshaller settings to prevent execution of potentially malicious code paths. Additionally, network segmentation and firewall rules should be implemented to limit cluster communication to only necessary endpoints, reducing the attack surface for potential exploitation attempts. According to ATT&CK framework category T1210, this vulnerability represents a technique that leverages deserialization flaws for privilege escalation, making it essential to implement comprehensive input validation and monitoring mechanisms across all session replication paths. Organizations should also consider upgrading to patched versions of JBoss Marshalling and Infinispan components, as well as implementing runtime monitoring to detect anomalous deserialization patterns that may indicate exploitation attempts.