A flaw was discovered in the JBoss Marshalling River unmarshaller. The component deserializes replicated session data without applying class filtering, allowing attackers to embed malicious classes and trigger arbitrary code execution through gadget chains. This vulnerability is a classic deserialization flaw classified as CWE‑502, resulting in remote code execution on every node that participates in the cluster session replication path.

The vulnerability affects Red Hat JBoss Enterprise Application Platform versions 7 and 8, as well as the Expansion Pack. All installations that use the Infinispan session replication feature and employ the JBoss Marshalling River unmarshaller are impacted, regardless of whether the products are deployed in a single‑node or multi‑node cluster environment.

The vulnerability carries a CVSS score of 8.8, representing high severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog, yet the impact of remote code execution on cluster nodes makes it a high‑risk exposure. Exploitation is likely to require an attacker who can influence session data—either through user input or compromise of the application. By injecting crafted serialized objects into replicated sessions, an attacker can trigger the deserialization path on all cluster members, leading to system compromise.