Wildfly contains an authentication bypass flaw in the IIOP subsystem. An unauthenticated remote attacker who can reach the IIOP port 3528 may supply an ITTPrincipalName in the service context. The CSIv2 security interceptor does not verify transport-level authentication, so the attacker’s supplied principal is accepted, enabling impersonation of any remote EJB principal on @Remote EJBs. This grants the attacker full authentication and access rights that belong to the impersonated principal, exposing the confidentiality, integrity, and availability of the affected services.

Affected by this issue are Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, the Red Hat JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign‑On 7. The advisory does not list specific JPES versions, so any installation of these products using Wildfly with the IIOP branch is potentially vulnerable until a patch is applied.

The CVSS score of 7.4 indicates a high‑severity vulnerability, and although an EPSS score is not available, the flaw permits unauthenticated remote control via a well‑known TCP port, making exploitation straightforward. The vulnerability is not listed in CISA’s KEV catalog, but the attack surface—port 3528—is exposed over the network and the logic flaw does not require special credentials. An attacker capable of reaching the IIOP interface could bypass authentication and impersonate any user; therefore the likelihood of exploitation is high if the IIOP port remains open to untrusted hosts.