CVE-2015-7501
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
Key facts
- CVSS score
- 9.8 (v3.0)
- Severity
- CRITICAL
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
- CWE-502
- EPSS score
- 85.6% (100th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2022-3799)
- Published
- November 9, 2017
- NVD last modified
- June 17, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2022-3799 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on August 6, 2024.
View on the EU Vulnerability DatabaseAffected products
- redhat / data grid
- redhat / jboss a-mq
- redhat / jboss bpm suite
- redhat / jboss data virtualization
- redhat / jboss data virtualization
- redhat / jboss enterprise application platform
- redhat / jboss enterprise application platform
- redhat / jboss enterprise application platform
- redhat / jboss enterprise brms platform
- redhat / jboss enterprise brms platform
- redhat / jboss enterprise soa platform
- redhat / jboss enterprise web server
- redhat / jboss fuse
- redhat / jboss fuse service works
- redhat / jboss operations network
- redhat / jboss portal
- redhat / openshift
- redhat / subscription asset manager
- redhat / xpaas
Certified products that may be affected
1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.
- JBoss Enterprise Application Platform Version 4.3 CP03 - Red Hat, Inc. - Common Criteria BSI-DSZ-CC-0531-2009 - archived
References
- http://rhn.redhat.com/errata/RHSA-2015-2500.html
- http://rhn.redhat.com/errata/RHSA-2015-2501.html
- http://rhn.redhat.com/errata/RHSA-2015-2502.html
- http://rhn.redhat.com/errata/RHSA-2015-2514.html
- http://rhn.redhat.com/errata/RHSA-2015-2516.html
- http://rhn.redhat.com/errata/RHSA-2015-2517.html
- http://rhn.redhat.com/errata/RHSA-2015-2521.html
- http://rhn.redhat.com/errata/RHSA-2015-2522.html
- http://rhn.redhat.com/errata/RHSA-2015-2524.html
- http://rhn.redhat.com/errata/RHSA-2015-2670.html
- http://rhn.redhat.com/errata/RHSA-2015-2671.html
- http://rhn.redhat.com/errata/RHSA-2016-0040.html
- http://rhn.redhat.com/errata/RHSA-2016-1773.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/78215(Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1034097(Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1037052(Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1037053(Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1037640(Third Party Advisory, VDB Entry)
- https://access.redhat.com/security/vulnerabilities/2059393(Vendor Advisory)
- https://access.redhat.com/solutions/2045023(Vendor Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=1279330(Issue Tracking, Third Party Advisory, VDB Entry, Vendor Advisory)
- https://rhn.redhat.com/errata/RHSA-2015-2536.html
- https://security.netapp.com/advisory/ntap-20240216-0010/
- https://www.oracle.com/security-alerts/cpujul2020.html
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain