Red Hat JBoss Enterprise Application Platform 7 vulnerabilities

Product

Red Hat JBoss Enterprise Application Platform 7

by Red Hat · last CVE Oct 21, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Severity mix

Critical 7High 44Medium 16Low 1

Severity

Exploitation

Watch

Add Red Hat JBoss Enterprise Application Platform 7 to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-10579	9.8	0%	Aug 11	Picketlink-federation: auth bypass in picketlink saml unsolicited-response Affected: All versions, or not specified
CVE-2026-49875	9.8	1%	Jun 12	Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils Affected: All versions, or not specified
CVE-2026-27727	9.8	1%	Feb 25	mchange-commons-java: Remote Code Execution via JNDI Reference Resolution Affected: All versions, or not specified
CVE-2025-12543	9.6	1%	Jan 7	Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf Affected: All versions, or not specified
CVE-2026-28369	9.1	1%	Mar 27	Undertow: undertow: request smuggling via malformed http request headers Affected: All versions, or not specified
CVE-2026-28367	9.1	1%	Mar 27	Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator Affected: All versions, or not specified
CVE-2026-28368	9.1	1%	Mar 27	Undertow: undertow: request smuggling via inconsistent header parsing Affected: All versions, or not specified