CVE-2026-19610— Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean

Quick assessment

Affected

Red Hat Red Hat JBoss Enterprise Application Platform 7

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 JBoss EAP 的 platform-mbean 组件中发现一处漏洞，该组件用于提供对 JVM 级指标和配置的管理访问。此问题源于运行时管理资源的 read-resource 操作处理器未能执行必要的基于角色的访问控制（RBAC）检查。这导致拥有低权限访问权限的已认证用户（例如 Monitor 角色）能够查看本应受到限制的系统敏感属性及 JVM 配置详情。

CVSS 6.5 · Medium Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1016 · System Network Configuration Discovery T1082 · System Information Discovery

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for the read-resource operation on the runtime management resource fails to perform required Role-Based Access Control (RBAC) checks. This allows an authenticated user with low-privileged access, such as the Monitor role, to view sensitive system properties and JVM configuration details that should be restricted.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
Red Hat	Red Hat JBoss Enterprise Application Platform 7	-	`cpe:/a:redhat:jboss_enterprise_application_platform:7`
Red Hat	Red Hat JBoss Enterprise Application Platform 7	-	`cpe:/a:redhat:jboss_enterprise_application_platform:7`
Red Hat	Red Hat JBoss Enterprise Application Platform 7	-	`cpe:/a:redhat:jboss_enterprise_application_platform:7`
Red Hat	Red Hat JBoss Enterprise Application Platform 7	-	`cpe:/a:redhat:jboss_enterprise_application_platform:7`
Red Hat	Red Hat JBoss Enterprise Application Platform 7	-	`cpe:/a:redhat:jboss_enterprise_application_platform:7`
Red Hat	Red Hat JBoss Enterprise Application Platform 7	-	`cpe:/a:redhat:jboss_enterprise_application_platform:7`
Red Hat	Red Hat JBoss Enterprise Application Platform 8	-	`cpe:/a:redhat:jboss_enterprise_application_platform:8`
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	-	`cpe:/a:redhat:jbosseapxp`
Red Hat	Red Hat Single Sign-On 7	-	`cpe:/a:redhat:red_hat_single_sign_on:7`

II. Public POCs for CVE-2026-19610

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-19610

请登录查看更多情报信息。

Other References for CVE-2026-19610 (2)

https://access.redhat.com/security/cve/CVE-2026-19610 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2514537 issue-tracking x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-19610

Same Patch Batch · Red Hat · 2026-10-29 · 8 CVEs total

CVE-2026-114488	7.4 HIGH	Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocation
CVE-2026-15564	7.4 HIGH	Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization
CVE-2026-117548	6.5 MEDIUM	389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schem
CVE-2026-117859	5.4 MEDIUM	Keycloak-services: keycloak-services: par single-use bypass via flow restart
CVE-2026-117627	5.4 MEDIUM	Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider l
CVE-2026-117688	5.3 MEDIUM	Keycloak-services: keycloak-services: vault secret disclosure via client registration inst
CVE-2026-118030	4.2 MEDIUM	Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse acr

IV. Related Vulnerabilities

Same product: Red Hat JBoss Enterprise Application Platform 7

Same vendor: Red Hat

Same weakness: CWE-862