CVE-2016-7065

high

Published 2016-10-13 · Modified 2026-05-06

CVSS v3

8.8

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2

6.5

VIR risk

8.8

Description

The JMX servlet in Red Hat JBoss Enterprise Application Platform (EAP) 4 and 5 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object.

Predictions

Exploit likelihood

92%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: secalert@redhat.com — https://bugzilla.redhat.com/show_bug.cgi?id=1382534

Application impact

Vendor	Product	Versions	Fixed
redhat	jboss_enterprise_application_platform	`4.0.0`
redhat	jboss_enterprise_application_platform	`5.0.0`

References

http://seclists.org/fulldisclosure/2016/Nov/143
http://www.securityfocus.com/bid/93462
https://bugzilla.redhat.com/show_bug.cgi?id=1382534
https://www.exploit-db.com/exploits/40842/
http://seclists.org/fulldisclosure/2016/Nov/143
http://www.securityfocus.com/bid/93462
https://bugzilla.redhat.com/show_bug.cgi?id=1382534
https://www.exploit-db.com/exploits/40842/

CWEs

CWE-502

Verify integrity in audit chain (admin only). AS-IS.