CVE-2025-2251: Org.jboss.eap:wildfly-ejb3: improper deserialization in jboss marshalling allows remote code execution
Vulnerability summary
CVE-2025-2251 is a medium (CVSS 6.2) Deserialization of Untrusted Data vulnerability. EPSS estimates a 1.06% chance of exploitation in the next 30 days, higher than 64.7% of scored vulnerabilities.
Not severe (CVSS 6.2, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5Timeline
- 07-04-2025PublishedVulnerability first disclosed.
- 19-08-2026Last modifiedVulnerability information updated.
Description
A security flaw exists in WildFly and JBoss Enterprise Application Platform (EAP) within the Enterprise JavaBeans (EJB) remote invocation mechanism. This vulnerability stems from untrusted data deserialization handled by JBoss Marshalling. This flaw allows an attacker to send a specially crafted serialized object, leading to remote code execution without requiring authentication.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST6.2MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H
EPSS trend
Probability
1.06%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
Increase +0.02 pp
From 1.05% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
No affected systems are recorded for this record.
Known conditions: network-reachable, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.