CVE-2025-23368: Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli
Vulnerability summary
CVE-2025-23368 is a high (CVSS 8.1) vulnerability in redhat data_grid. EPSS estimates a 0.89% chance of exploitation in the next 30 days, higher than 59.2% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3Timeline
- 04-03-2025PublishedVulnerability first disclosed.
- 19-10-2026Last modifiedVulnerability information updated.
Description
A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.89%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.89% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (gruppotim.it)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat3 products
- data_grid8.0
- jboss_enterprise_application_platform7.0.0 | 8.0.0
- wildfly_core< 31.0.3
Org.wildfly.core1 product
- wildfly-elytron-integration≥ 32.0.0.Beta1, < 32.0.0.Beta3 | < 31.0.3.Final
2 vendors · 4 products
