CVE-2025-2251
MediumCVSS 6.2Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
A security flaw in WildFly and JBoss EAP in the EJB remote invocation mechanism results from untrusted data deserialization by JBoss Marshalling. It allows an attacker to send a specially crafted object, leading to remote code execution without authentication.
Risk Assessment
The risk for the organization includes the possibility of a complete takeover of the application server by an unauthenticated attacker, potentially leading to data loss, service disruption, and infrastructure compromise.
Recommendation
It is recommended to immediately update WildFly and JBoss EAP to versions containing the fix and restrict access to EJB remote invocation to trusted networks only.
Original NVD description (English source)
A security flaw exists in WildFly and JBoss Enterprise Application Platform (EAP) within the Enterprise JavaBeans (EJB) remote invocation mechanism. This vulnerability stems from untrusted data deserialization handled by JBoss Marshalling. This flaw allows an attacker to send a specially crafted serialized object, leading to remote code execution without requiring authentication.