Red Hat Security AdvisoryRHSA-2026:67604
Red Hat JBoss Enterprise Application Platform 7.4.25 security update
Released 2026-09-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-activemq-artemis-2.16.0-23.redhat_00058.1.el7eap, eap7-activemq-artemis-cli-2.16.0-23.redhat_00058.1.el7eap, eap7-activemq-artemis-commons-2.16.0-23.redhat_00058.1.el7eap +28
- Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-activemq-artemis-2.16.0-23.redhat_00058.1.el8eap, eap7-activemq-artemis-cli-2.16.0-23.redhat_00058.1.el8eap, eap7-activemq-artemis-commons-2.16.0-23.redhat_00058.1.el8eap +29
- Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-activemq-artemis-2.16.0-23.redhat_00058.1.el9eap, eap7-activemq-artemis-cli-2.16.0-23.redhat_00058.1.el9eap, eap7-activemq-artemis-commons-2.16.0-23.redhat_00058.1.el9eap +29
Fixes 5 records
Priority MEDIUM 52
An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01468 · Published 2026-09-10 · Partial fix CWE-306
Priority MEDIUM 48
An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00566 · Published 2026-09-10 · Partial fix CWE-306
Priority MEDIUM 40
An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00821 · Published 2026-09-10 · Partial fix CWE-306
Priority LOW 30
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00443 · Published 2026-06-23 · Partial fix · 2.18.9, 2.21.5 +2 CWE-915
Priority LOW 29
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00346 · Published 2026-07-14 · Partial fix · 2.18.9, 2.21.5 +3 CWE-863
THREATIST.IORead the docs