Read the docs
TI-2015-05403 Aliases CVE-2015-6420GHSA-6hgm-866r-3cjv

Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint…

Priority HIGH 70CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.24233 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed org.apache.commons:commons-collections4 (Maven): 4.1commons-collections:commons-collections (Maven): 3.2.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.commons:commons-collections4 (Maven)before 4.14.1Patch availableGHSA-6hgm-866r-3cjv
—commons-collections:commons-collections (Maven)before 3.2.23.2.2Patch availableGHSA-6hgm-866r-3cjv
—net.sourceforge.collections:collections-generic (Maven)up to 4.0.1—No fix listedGHSA-6hgm-866r-3cjv
—org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic (Maven)up to 4.01—No fix listedGHSA-6hgm-866r-3cjv
—org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections (Maven)up to 3.2.1—No fix listedGHSA-6hgm-866r-3cjv
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.commons:commons-collections4 (Maven) Vendor— Affected before 4.1 Fixed in 4.1 Patch available GHSA-6hgm-866r-3cjv
  • commons-collections:commons-collections (Maven) Vendor— Affected before 3.2.2 Fixed in 3.2.2 Patch available GHSA-6hgm-866r-3cjv
  • net.sourceforge.collections:collections-generic (Maven) Vendor— Affected up to 4.0.1 Fixed in — No fix listed GHSA-6hgm-866r-3cjv
  • org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic (Maven) Vendor— Affected up to 4.01 Fixed in — No fix listed GHSA-6hgm-866r-3cjv
  • org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections (Maven) Vendor— Affected up to 3.2.1 Fixed in — No fix listed GHSA-6hgm-866r-3cjv

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:commons_collections:*:*:*:*:*:*:*:*3.0 to before 3.2.2VulnerableApache
cpe:2.3:a:apache:commons_collections:4.0:*:*:*:*:*:*:*4.0VulnerableApache
  • cpe:2.3:a:apache:commons_collections:*:*:*:*:*:*:*:* Versions 3.0 to before 3.2.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:commons_collections:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-6hgm-866r-3cjv org.apache.commons:commons-collections4 (Maven) Fixed in 4.1 Advisory →
  • Fix · GHSA-6hgm-866r-3cjv commons-collections:commons-collections (Maven) Fixed in 3.2.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-6420
  2. 2026-10-03 Alias added: GHSA-6hgm-866r-3cjv
  3. 2026-10-07 CVSS score added · CISA ADP
  4. 2026-10-07 Weakness changed · CISA ADP
  5. 2026-10-07 CISA SSVC decision points changed
  6. 2026-10-07 Priority changed: MEDIUM → HIGH

References

Exploit 1

Advisory 11

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences