PatchTheCVE: wildfly

CVE-2025-23367: A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider

Fri, 18 Sep 2026 00:16:51 +0000

MEDIUM 6.5: A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor rol

CVE-2022-1278: A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the tra

Wed, 17 Jun 2026 04:22:08 +0000

HIGH 7.5: A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.

CVE-2021-3644: A flaw was found in wildfly-core in all versions

Wed, 17 Jun 2026 04:05:29 +0000

LOW 3.3: A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly retrieve

CVE-2022-0866: This is a concurrency issue that can result in the wrong caller principal being returned from the session cont

Wed, 17 Jun 2026 04:21:23 +0000

MEDIUM 5.3: This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.j

CVE-2021-3503: A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data

Wed, 17 Jun 2026 04:05:14 +0000

MEDIUM 4.3: A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality.

CVE-2020-1719: A flaw was found in wildfly

Wed, 17 Jun 2026 03:02:16 +0000

MEDIUM 5.4: A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before wildfly 20.0.0.Final are affected.

CVE-2020-14317: It was found that the issue for security flaw CVE-2019-3805 appeared again in a further version of JBoss Enter

Wed, 17 Jun 2026 02:54:31 +0000

MEDIUM 5.5: It was found that the issue for security flaw CVE-2019-3805 appeared again in a further version of JBoss Enterprise Application Platform - Continuous Delivery (EAP-CD) introducing regression. An attacker could exploit this by modifying the PID file in /var/run/jboss-eap/ allowing the init.d script t

CVE-2020-27822: A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.

Wed, 17 Jun 2026 03:09:41 +0000

MEDIUM 5.9: A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final. When an application uses the OpenTracing API's java-interceptors, there is a possibility of a memory leak. This flaw allows an attacker to impact the availability of the server. T

CVE-2020-25640: A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at w

Wed, 17 Jun 2026 03:07:01 +0000

MEDIUM 5.3: A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.

CVE-2020-10718: A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has a

Wed, 17 Jun 2026 02:48:18 +0000

HIGH 7.5: A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thread Context Classloader (TCCL). This setting is exposed as a public method, which can bypass the security manager. The highest threat from this vulnerability is t

CVE-2020-10740: A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is

Wed, 17 Jun 2026 02:48:21 +0000

MEDIUM 6.6: A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB) due to lack of validation/filtering capabilities in wildfly.

CVE-2019-14887: A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the

Wed, 17 Jun 2026 02:19:14 +0000

CRITICAL 9.1: A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption. This

CVE-2019-3894: It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 store

Wed, 17 Jun 2026 02:35:49 +0000

HIGH 8.8: It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run the thread as. These threads do not necessarily terminate if the keep alive time has not expired. This could allow a shared thread to use the wrong security ident

CVE-2019-3805: A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to exec

Wed, 17 Jun 2026 02:35:37 +0000

MEDIUM 4.7: A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d script to terminate arbitrary processes on the system. An attacker could exploit this by modifying the PID file in /var/run/jboss-eap/ allowing the init.d script to terminate any

CVE-2018-14627: The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport i

Wed, 17 Jun 2026 01:41:19 +0000

MEDIUM 5.3: The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required. Servers before this version that are configured with the following setting allow clients to create plaintext connections:

CVE-2018-10683: An issue was discovered in WildFly 10.1.2.Final

Wed, 17 Jun 2026 01:34:30 +0000

CRITICAL 9.8: An issue was discovered in WildFly 10.1.2.Final. In the case of a default installation without a security realm reference, an attacker can successfully access the server without authentication. NOTE: the Security Realms documentation in the product's Admin Guide indicates that "without a security re

CVE-2018-10682: An issue was discovered in WildFly 10.1.2.Final

Wed, 17 Jun 2026 01:34:29 +0000

CRITICAL 9.8: An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TCP port 9990 without any authentication using "anonymous" access that is automatically created. Once logged in, a misconfiguration present by default (auto-deployment) permits an an