CVSS 3.0
9.8 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2015-7501
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
Severity
- EPSS
- 86% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- redhat:data_grid
- redhat:jboss_a-mq
- redhat:jboss_bpm_suite
- redhat:jboss_data_virtualization
- redhat:jboss_enterprise_application_platform
- redhat:jboss_enterprise_brms_platform
- redhat:jboss_enterprise_soa_platform
- redhat:jboss_enterprise_web_server
- redhat:jboss_fuse
- redhat:jboss_fuse_service_works
- redhat:jboss_operations_network
- redhat:jboss_portal
- redhat:openshift
- redhat:subscription_asset_manager
- redhat:xpaas
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fjq5-5j5f-mvxh | Maven | commons-collections:commons-collections | <3.2.2 | 3.2.2 |
| GHSA-fjq5-5j5f-mvxh | Maven | org.apache.commons:commons-collections4 | <4.1 | 4.1 |
| GHSA-fjq5-5j5f-mvxh | Maven | org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections | >=3.2.1 | no fix published |
| GHSA-fjq5-5j5f-mvxh | Maven | net.sourceforge.collections:collections-generic | 4.01 | no fix published |
| GHSA-fjq5-5j5f-mvxh | Maven | org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic | >=4.01 | no fix published |