Red Hat JBoss - Insecure Deserialization
CVE-2015-7501
Verified
Description
Red Hat JBoss Application Server (4.x, 5.x, 6.x) contains an insecure deserialization vulnerability in the JMXInvokerServlet and EJBInvokerServlet HTTP Invoker endpoints. These endpoints deserialize arbitrary Java objects from unauthenticated HTTP POST requests. An attacker can send a crafted Apache Commons Collections gadget chain to achieve remote code execution. CVE-2015-7501 is the original 2015 FoxGlove Security disclosure of the Java Commons Collections deserialization vulnerability class.
Severity
Critical
CVSS Score
9.8
Exploit Probability
86%
Affected Product
jboss_enterprise_application_platform
Published Date
August 17, 2026
Template Author
pdteam, dhiyaneshdk
CVE-2015-7501.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2015-7501
CWE ID:
cwe-502
References
https://nvd.nist.gov/vuln/detail/CVE-2015-7501https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/https://access.redhat.com/security/vulnerabilities/986a8488-052e-46d1-8ede-c55cbfceb822https://github.com/ianxtianxt/CVE-2015-7501https://github.com/jas502n/Jboss_JMXInvokerServlet_Deserialization_RCEhttps://www.blackduck.com/blog/mitigate-java-deserialization-vulnerability-jboss.html
Remediation Steps
Apply Red Hat Security Advisory RHSA-2015:2538. Upgrade to JBoss EAP 7.x which removes the affected invoker servlets. Restrict access to /invoker/* endpoints via jboss-web.xml security constraints. Update Apache Commons Collections to version 3.2.2 or 4.1 or later.