10

CVE-2015-7501: Apache Commons Collections library Deserialization of Untrusted Data

CVSS: 10.0v2.0HighKEVModified
AliasesMGASA-2016-0012RHSA-2015:2500RHSA-2015:2521
Published 09-11-2017Last modified 06-08-2024
Open JSON

Vulnerability summary

CVE-2015-7501 is a high (CVSS 10.0) Deserialization of Untrusted Data vulnerability in Apache Commons Collections library. It is known to be exploited: ENISA lists it, first on 14-07-2025. EPSS estimates a 85.56% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
10.0/10
010
High · v2.0 (NVD)
EPSS score
85.56%
0%100%
Critical · 0.00 pp in 30 days
KEVListedENISA
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5
RHSA-2015:2538RHSA-2015:2539RHSA-2015:2540RHSA-2015:2542RHSA-2016:1773

Timeline

  1. 09-11-2017
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.
  3. 14-07-2025
    Added to ENISA KEVAdded to the ENISA known exploited vulnerabilities catalog.

Description

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

CVSS metrics

7 scores · 6 sources · 3 versions

EPSS trend

Probability

85.56%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 85.56% on 18-09-2026

18-09-202618-10-2026
EPSS score
85.56%

Known exploited

Compare KEV catalogs
ENISA CNWListed
Added
14-07-2025

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat32 products
Chainguard18 products
  • eco-java-gradle-1.11All versions (No fix recorded)
  • eco-java-gradle-2.0All versions (No fix recorded)
  • eco-java-gradle-2.1All versions (No fix recorded)
  • eco-java-gradle-2.10All versions (No fix recorded)
  • eco-java-gradle-2.11All versions (No fix recorded)
Debian2 products
  • libcommons-collections3-java< 3.2.2-1
  • libcommons-collections4-javaAll versions (No fix recorded)
Org.apache.servicemix.bundles2 products
  • org.apache.servicemix.bundles.collections-generic≥ 4.01 (No fix recorded)
  • org.apache.servicemix.bundles.commons-collections≥ 3.2.1 (No fix recorded)
Ubuntu2 products
  • libcommons-collections3-javaAll versions (No fix recorded)
  • libcommons-collections4-javaAll versions (No fix recorded)
Commons-collections1 product
  • commons-collections< 3.2.2
Mageia1 product
  • apache-commons-collections< 3.2.1-24.1.mga5
Net.sourceforge.collections1 product
  • collections-generic4.01
Org.apache.commons1 product
  • commons-collections4< 4.1

9 vendors · 60 products

References

73 links
Show all 73 references