Description

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-11T09:17:12.540Z",
  "pubdate": "2026-08-11T09:17:12.540Z",
  "executiveSummary": "A critical remote code execution vulnerability exists in the JBoss Marshalling component as utilized within the Infinispan session replication path. The flaw stems from the insecure deserialization of replicated session data using the JBoss Marshalling River unmarshaller without proper class filtering mechanisms.\nThis vulnerability impacts JBoss Marshalling and Infinispan cluster nodes utilizing vulnerable session replication configurations. Successful exploitation grants an attacker the capability to execute arbitrary code with the privileges of the application server process across every cluster node.\nThe risk implication is severe, as it can lead to total cluster compromise, data exfiltration, and lateral movement within the affected network. Attackers do not require pre-existing authentication if the replication endpoints or cluster communication channels are exposed or reachable, enabling the injection of malicious deserialization gadget chains directly into the replication stream.",
  "technicalDetails": "The root cause of the vulnerability resides in the lack of input validation and class filtering during the object deserialization process handled by the JBoss Marshalling River unmarshaller. When session data is replicated across the Infinispan cluster, the receiving nodes deserialize the incoming byte streams without restricting the classes that can be instantiated.\nThe vulnerable component is the JBoss Marshalling integration within the Infinispan session replication path. Exploitation occurs when an attacker crafts a malicious serialized payload containing known deserialization gadget chains and injects this data into the Infinispan session replication stream.\nThe step-by-step attack flow proceeds as follows: First, the attacker identifies or gains access to the Infinispan cluster communication path or session replication mechanism. Second, the attacker crafts a serialized payload encapsulating a gadget chain designed to execute arbitrary system commands or code upon instantiation. Third, the crafted payload is transmitted into the replication path, mimicking legitimate session state updates. Fourth, the receiving cluster nodes ingest the payload and pass it to the JBoss Marshalling River unmarshaller. Finally, because no class filtering is enforced, the unmarshaller instantiates the malicious gadget classes, triggering the payload execution and achieving remote code execution on every node participating in the cluster replication.\nPost-exploitation impact includes full system compromise, persistent backdoor installation, access to sensitive session data, and potential pivot points into internal network segments hosting the cluster infrastructure."
}