CVE-2026-24330Medium· 6.5▾ SunlitA flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.5%
A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive. This could lead to further exploitation, such as arbitrary file read vulnerabilities.
wildfly-core-security (all versions)wildfly-core-security (all versions)wildfly-core-securitywildfly-core-security (all versions)wildfly-core-security (all versions)wildfly-core-security (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
To mitigate this vulnerability, restrict access to the 'deployer' account to only authorized and trusted administrators. Implement strong authentication policies for this account and consider limiting its permissions to prevent the deployment of untrusted applications. Ensure that the WildFly management interfaces are not exposed to untrusted networks and that only verified and signed applications are permitted for deployment. If the 'deployer' role is not strictly necessary, consider disabling or removing it. Changes to WildFly configuration may require a service restart to take effect.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115485Medium· 6.3open-iscsi: open-iscsi: DHCPv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio (CVE-2026-115485)
CVE-2026-115484High· 7.6open-iscsi: open-iscsi: DHCPv4 option parser heap out-of-bounds read in iscsiuio parse_msg (CVE-2026-115484)
CVE-2026-115486High· 7.1open-iscsi: open-iscsi: IPv6 Neighbor Discovery missing option length validation in iscsiuio allows ARP table poisoning (CVE-2026-115486)
CVE-2026-114620Medium· 4.8authlib: Authlib: Server-Side Request Forgery via unvalidated request URI (CVE-2026-114620)
CVE-2026-114619Medium· 4.6authlib: authlib: authorization bypass via improper scope check in OpenID implicit grant (CVE-2026-114619)
CVE-2026-114618Medium· 6.8authlib: Authlib: Unauthorized access via improper JWT audience validation (CVE-2026-114618)