PatchTheCVECVE-2018-14627: The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport i
CVE-2018-14627 is a medium-severity flaw (CVSS 5.3) affecting wildfly. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required. Servers before this version that are configured with the following setting allow clients to create plaintext connections: <transport-config confidentiality="required" trust-in-target="supported"/>
Why this priority
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 1.1% (top 34%) |
| CISA exploited list | No |
| Weakness | CWE-319 |
| Published | 2018-09-04 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2018-14627?
wildfly: upgrade to 14.0.0. Exact commands for each OS are on this page.
Is CVE-2018-14627 being exploited?
CVE-2018-14627 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2018-14627 affect?
CVE-2018-14627 affects wildfly. Severity is medium (CVSS 5.3). The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required. Servers before this version that are configured with the following setting allow clients to create plaintext connectio
How urgent is CVE-2018-14627?
Priority 40/100. On your watchlist
Software pages
JBoss and WildFly vulnerabilities
Related CVEs
- CVE-2025-23367 MEDIUM 6.5 UPGRADE UPGRADE A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider
- CVE-2022-1278 HIGH 7.5 UPGRADE DOWNGRADE A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the tra
- CVE-2022-0866 MEDIUM 5.3 DOWNGRADE DOWNGRADE This is a concurrency issue that can result in the wrong caller principal being returned from the session cont
- CVE-2021-3644 LOW 3.3 DOWNGRADE DOWNGRADE A flaw was found in wildfly-core in all versions
- CVE-2021-3503 MEDIUM 4.3 UPGRADE A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data