Vulnerability record/PUBLISHED/Published Aug 11, 2026 08:49:54 UTC
CVE-2026-15563
A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.
Base score7.4/ 10
SeverityHighCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityHigh
Attack vectorNetworkAV
Attack complexityHighAC
Privileges requiredNonePR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactHighC
Integrity impactHighI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityredhat
Last updatedNov 1, 2026 01:22:51 UTC
PublishedAug 11, 2026 08:49:54 UTC
ReservedJul 13, 2026 05:38:15 UTC