Wildfly’s IIOP listener accepts incoming streams before authenticating the connection. An attacker that can send data to the IIOP port can craft malicious objects that, if the target Enterprise Java Bean allows untyped method parameters, may be deserialized into the Java runtime. Successful deserialization could enable arbitrary code execution or privilege escalation depending on the gadget chains available in the application classpath.

Red Hat JBoss Enterprise Application Platform 7 and 8 are affected. The vulnerability is tied to the iiop-openjdk subsystem that exposes a listener on TCP port 3528.

The CVSS score of 7.4 indicates high severity. EPSS is not available, so the current threat likelihood is unknown, and the vulnerability is not listed in CISA KEV catalog. The likely attack vector is remote access to the open IIOP listener unless network restrictions are in place. Once an attacker reaches this listener, the lack of pre-authentication opens a window for deserialization attacks that could compromise confidentiality, integrity, or availability of the server.