Loading story…
Apache Commons Collections contained a critical unsafe-deserialization vulnerability, CVE-2015-7501, in its serializable InvokerTransformer component. An attacker able to supply crafted serialized Java objects to exposed endpoints—including JMX, RMI, or remote EJB services—could chain vulnerable classes with sun.reflect.annotation.AnnotationInvocationHandler to execute arbitrary code under the permissions of the affected Java application. The flaw affected Commons Collections 3.0 and 4.0 and exposed products and applications using the library, including WebLogic, WebSphere, JBoss, Jenkins, and OpenNMS.
Apache addressed the issue in Commons Collections versions 3.2.2 and 4.1 by preventing InvokerTransformer transformations following deserialization. Red Hat also issued a critical update for JBoss Operations Network 3.3.4, directing customers to shut down and patch every server individually, including each node in high-availability deployments. Organizations should identify applications that deserialize untrusted Java objects and either upgrade the library or apply vendor-provided patches.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued a critical security update for JBoss Operations Network 3.3 Update 4 to remediate CVE-2015-7501, which could allow remote code execution during deserialization through a specially constructed class chain. The patch replaced vulnerable commons-collections library files for affected JBoss ON 3.3.4 deployments.
Apache Commons Collections addressed an unsafe deserialization flaw in serializable InvokerTransformer that could be combined with AnnotationInvocationHandler to execute arbitrary Java code through exposed serialized-object endpoints. Fixes were released in Commons Collections 3.2.2 and 4.1.
Foxglove Security published research on a vulnerability affecting Java applications and products including WebLogic, WebSphere, JBoss, Jenkins, and OpenNMS.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
commons.apache.org
Open sourceaccess.redhat.com
Open sourceblogs.apache.org
Open sourceissues.apache.org
Open sourcefoxglovesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat issued Critical updates for **CVE-2015-7501**, an Apache Commons Collections unsafe Java deserialization flaw that can let a remote attacker execute arbitrary code under the privileges of an affected application. Exploitation requires an exposed endpoint that accepts and blindly deserializes untrusted serialized data while vulnerable Commons Collections classes are on the application classpath; unauthenticated access to `JMXInvokerServlet` can satisfy these conditions in affected deployments. Affected offerings include JBoss SOA Platform 5.3.1, JBoss Data Grid 6.4.1 and 6.5.1, JBoss Data Virtualization 6.0.0–6.2.0, JBoss EAP 5.2, JBoss Operations Network 3.3.4, and JBoss BPM Suite 6.1.0. Organizations should apply the relevant Red Hat security updates, back up installations, and stop and restart JBoss services as required; applications that ship their own Commons Collections JARs may remain vulnerable and require separate remediation or removal of the vulnerable classes after testing.
Aug 29, 2026
A deserialization vulnerability tracked as **`CVE-2026-25747`** affects the Apache Camel LevelDB component and can lead to arbitrary code execution. Red Hat rated the issue **Important** with a **CVSS v3 score of 7.8**, stating the flaw stems from Camel-LevelDB using **`java.io.ObjectInputStream`** to read LevelDB aggregation repository data without validation or class-loading restrictions. If an attacker can write a malicious serialized Java object into the LevelDB database files, the application may deserialize it and execute attacker-controlled code. Red Hat said no acceptable mitigation is currently available under its product security criteria. In its product status matrix, **Red Hat build of Apache Camel for Spring Boot 4** and **Red Hat Fuse 7** are marked **Will not fix**, while **Red Hat JBoss Enterprise Application Platform 8** and the **JBoss Enterprise Application Platform Expansion Pack** are listed as **Not affected** because the vulnerable component is not present. The issue is cataloged in the CVE program as **`CVE-2026-25747`**.
Aug 20, 2026
Apache disclosed **CVE-2026-50076**, an important- to high-severity deserialization vulnerability in the Java SDK of Apache Fory that affects `org.apache.fory:fory-core` versions before `1.1.0`. The flaw lies in the Java `ReplaceResolverSerializer` replace-resolve path, where incomplete verification allows crafted Fory serialized data to bypass class registration requirements, `TypeChecker` enforcement, and `DisallowedList` protections during deserialization. If an application processes untrusted external data streams, a remote attacker can trigger classpath-present `readResolve` and `readExternal` hooks on Java/JVM systems, creating a path to unauthorized code execution on backend servers. Apache fixed the issue in version `1.1.0` by adding stricter sanitization checks before deserialization and advised users to upgrade immediately and review deployments that deserialize externally supplied data; the vulnerability was reported by Venkatraman Kumar (**r3dw0lfsec**) of Securin.
Jun 29, 2026