CVE-2026-114488

The record

A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to impersonate any principal on every IIOP-exposed @Remote EJB.

Affected packages

Related vulnerabilities

• CVE-2026-63184 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-829
• CVE-2026-118762 Monkeytype is a minimalistic and customizable typing test. CWE-829
• CVE-2023-7357 A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher… CWE-829
• CVE-2026-15564 Wildfly's IIOP listener may permit deserialization of input streams before authentication… CWE-829
• CVE-2026-84725 when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR… CWE-829
• CVE-2026-59172 Joker is a small Clojure interpreter, linter and formatter written in Go. CWE-829
• CVE-2026-59176 Functype is a family of TypeScript functional programming libraries. CWE-829
• CVE-2026-65119 NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter… CWE-829