Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.26 security update

Fixed packages 28

Vulnerabilities 6

• Critical 9.8
  CVE-2026-57967 Public exploit

  Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

  An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache Activ…

  Apache Software Foundation Apache ActiveMQ Artemis Apache Artemis
  Sep 10, 2026
• Critical 9.8
  CVE-2026-66909

  Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage

  Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized ob…

  Apache Software Foundation Apache CXF
  Aug 6, 2026
• Critical 9.1
  CVE-2026-49364

  Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers

  An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0…

  Apache Software Foundation Apache ActiveMQ Artemis Apache Artemis
  Sep 10, 2026
• High 8.1
  CVE-2026-84725

  Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap

  when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before…

  Red Hat Red Hat JBoss Enterprise Application Platform 8.1 Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
  Oct 28, 2026
• High 7.5
  CVE-2026-49362

  Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation

  An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Art…

  Apache Software Foundation Apache ActiveMQ Artemis Apache Artemis
  Sep 10, 2026
• Medium 5.3
  CVE-2026-54515 Public exploit

  jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

  jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are appli…

  FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Jun 23, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477945
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2478013
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480638
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2492016
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2511983
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2527228
• article
  https://issues.redhat.com/browse/JBEAP-33495
• article
  https://issues.redhat.com/browse/JBEAP-34322
• article
  https://issues.redhat.com/browse/JBEAP-34522
• article
  https://issues.redhat.com/browse/JBEAP-34913
• article
  https://issues.redhat.com/browse/JBEAP-34914
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99099.json
• report
  https://access.redhat.com/security/cve/CVE-2026-49362
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-49362
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-49362
• report
  https://access.redhat.com/security/cve/CVE-2026-49364
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-49364
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-49364
• report
  https://access.redhat.com/security/cve/CVE-2026-54515
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-54515
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-54515
• article
  https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa
• article
  https://github.com/FasterXML/jackson-databind/issues/5962
• article
  https://github.com/FasterXML/jackson-databind/issues/5964
• article
  https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v
• report
  https://access.redhat.com/security/cve/CVE-2026-57967
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-57967
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-57967
• report
  https://access.redhat.com/security/cve/CVE-2026-66909
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-66909
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-66909
• article
  https://lists.apache.org/thread/lr5d4tg6tf7j29jmw8wt242oowonjqpx
• report
  https://access.redhat.com/security/cve/CVE-2026-84725
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-84725
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-84725