Description
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libcommons-collections3-java | 3.2.2-1 | — |
| Debian 14 | libcommons-collections4-java | No fix yet | — |
| Debian 13 | libcommons-collections3-java | 3.2.2-1 | — |
| Debian 13 | libcommons-collections4-java | No fix yet | — |
| Debian 12 | libcommons-collections3-java | 3.2.2-1 | — |
| Debian 12 | libcommons-collections4-java | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libcommons-collections4-java | No fix yet | — |
| Ubuntu 26.04 LTS | libcommons-collections4-java | No fix yet | — |
| Ubuntu 25.10 | libcommons-collections4-java | No fix yet | — |
| Ubuntu 24.04 LTS | libcommons-collections4-java | No fix yet | — |
| Ubuntu 22.04 LTS | libcommons-collections4-java | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libcommons-collections4-java | No fix yet | — |
| Ubuntu 18.04 LTS | libcommons-collections4-java | No fix yet | — |
| Ubuntu 16.04 LTS | libcommons-collections4-java | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | apache-commons-collections +3 | 3.2.1-22.el7_2 | RHSA-2015:2522 |
| RHEL 6 | jakarta-commons-collections +4 | 3.2.1-3.5.el6_7 | RHSA-2015:2521 |
| RHEL 5 | jakarta-commons-collections +4 | 3.2-2jpp.4 | RHSA-2015:2671 |
| RHEL 3 | rh-maven35-apache-commons-collections4 +1 | 4.0-7.3.el7 | RHSA-2020:4274 |
| RHEL 2 | rh-java-common-apache-commons-collections +3 | 3.2.1-21.13.el6 | RHSA-2015:2523 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 2 | ImageMagick +3 | 6.7.2.7-5.el6_8 | RHSA-2016:1773 |
| Red Hat OpenShift 2 | activemq +1 | 5.9.0-6.redhat.611463.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | jenkins | 1.651.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | libcgroup +1 | 0.40.rc1-18.el6_8 | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-broker | 1.16.3.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-broker-util | 1.37.6.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-cron | 1.25.4.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-diy +1 | 1.26.2.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-haproxy | 1.31.6.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-jbosseap | 2.27.4.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-jbossews | 1.35.5.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-jenkins | 1.29.2.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-jenkins-client | 1.26.1.1-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-mysql | 1.31.3.3-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-nodejs | 1.33.1.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-perl +1 | 1.30.2.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-php | 1.35.4.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-python | 1.34.3.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-ruby | 1.32.2.2-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | openshift-origin-node-proxy | 1.26.3.1-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | rhc +1 | 1.38.7.1-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-admin-console | 1.28.2.1-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-frontend-haproxy-sni-proxy | 0.5.2.1-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-msg-broker-mcollective | 1.36.2.4-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-node +1 | 1.38.6.4-1.el6op | RHSA-2016:1773 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-routing-daemon | 0.26.6.1-1.el6op | RHSA-2016:1773 |
| Red Hat JBoss EAP 6 | apache-commons-collections-eap6 | 3.2.1-16.redhat_5.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | hibernate4-eap6 +4 | 4.2.21-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.25-7.SP6_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | ironjacamar-eap6 +9 | 1.0.34-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | jboss-as-ee +61 | 7.5.5-2.Final_redhat_3.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | jboss-ec2-eap +1 | 7.5.5-3.Final_redhat_3.ep6.el6 | RHSA-2015:2542 |
| Red Hat JBoss EAP 6 | jboss-ejb-client | 1.0.32-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | jboss-hal +1 | 2.5.11-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | jboss-jsf-api_2.1_spec | 2.1.28-5.SP1_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | jboss-remoting3 | 3.3.6-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | jboss-security-negotiation | 2.3.10-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | jboss-xnio-base | 3.0.15-1.GA_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.5.5-3.Final_redhat_3.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.12-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 6 | picketbox | 4.1.2-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:2540, RHSA-2015:2539, RHSA-2015:2538 |
| Red Hat JBoss EAP 5 | jakarta-commons-collections +1 | 3.2.1-5.ep5.el4 | RHSA-2015:2535 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | apache-commons-collections +3 | 3.2.1-22.el7_2 | ELSA-2015-2522 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
ianxtianxt/CVE-2015-7501 ★ 22 · Feb 21, 2020
（CVE-2015-7501）JBoss JMXInvokerServlet 反序列化漏洞
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Red Hat JBoss - Insecure Deserialization http/cves/2015/CVE-2015-7501.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | commons-collections:commons-collections | < 3.2.2 | 3.2.2 | GHSA-fjq5-5j5f-mvxh |
| Maven | net.sourceforge.collections:collections-generic | 4.01 | — | GHSA-fjq5-5j5f-mvxh |
| Maven | org.apache.commons:commons-collections4 | < 4.1 | 4.1 | GHSA-fjq5-5j5f-mvxh |
| Maven | org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic | >= 4.01 | — | GHSA-fjq5-5j5f-mvxh |
| Maven | org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections | >= 3.2.1 | — | GHSA-fjq5-5j5f-mvxh |
Advisories 17
- RHSA-2020:4274 Red Hat Security Advisory: rh-maven35-apache-commons-collections4 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:1773 Red Hat Security Advisory: Red Hat OpenShift Enterprise 2.2.10 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:2671 Red Hat Security Advisory: jakarta-commons-collections security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:2542 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.5 jboss-ec2-eap update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:2539 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.5 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:2540 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.5 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:2538 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.5 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:2535 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:2536 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:2522 Red Hat Security Advisory: apache-commons-collections security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:2523 Red Hat Security Advisory: rh-java-common-apache-commons-collections security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:2521 Red Hat Security Advisory: jakarta-commons-collections security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:2500 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- WID-SEC-2022-1738 IBM InfoSphere Information Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2025
- WID-SEC-2025-2440 Red Hat JBoss Enterprise Application Platform: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes BSI CERT-Bund (WID) · Oct 29, 2025
- WID-SEC-2024-1277 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024
- ELSA-2015-2522 Important: apache-commons-collections security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 30, 2015
References
- RHSA-2016:0040 vendor-advisory
- RHSA-2015:2670 vendor-advisory
- RHSA-2015:2501 vendor-advisory
- RHSA-2015:2517 vendor-advisory
- 78215 vdb-entry
- 1034097 vdb-entry
- RHSA-2015:2671 vendor-advisory
- 1037052 vdb-entry
- 1037640 vdb-entry
- RHSA-2015:2522 vendor-advisory
- RHSA-2015:2521 vendor-advisory
- RHSA-2015:2516 vendor-advisory
- RHSA-2015:2500 vendor-advisory
- RHSA-2015:2514 vendor-advisory
- RHSA-2015:2502 vendor-advisory
- RHSA-2015:2536 vendor-advisory
- RHSA-2016:1773 vendor-advisory
- RHSA-2015:2524 vendor-advisory
- 1037053 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1279330
- https://access.redhat.com/solutions/2045023
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- https://access.redhat.com/security/vulnerabilities/2059393
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://security.netapp.com/advisory/ntap-20240216-0010/