CVE-2017-7504JBoss Insecure Deserialization
HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server <= Jboss 4.X does not restrict the classes for which it performs deserialization, which allows remote attackers to execute…
Published May 19, 2017 · Updated May 12, 2026
Key Facts
Patch immediately- CVE-2017-7504 is a critical-severity vulnerability (CVSS 9.8 v3) affecting Jboss Enterprise Application Platform (Redhat), JBoss.
- It is exploited in the wild, listed in Industry KEV feed since Mar 23, 2023. No public exploit code is known.
- EPSS estimates a 39% probability of exploitation in the next 30 days.
- Fixed versions are available, including Jboss Enterprise Application Platform 4.0.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Scores
CVSS v3
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
39%
Higher than 98.5% of all scored CVEs
Exploit maturity
Exploited (KEV)
ATLAS score
53/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Mar 23, 2023
2134 days after publication
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Exploited (KEV)
Public exploit code
0
Proof-of-concept links
In-the-wild evidence
3
Reports of active use
Advisories And Exploit References
- advisory98595
Description
HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server <= Jboss 4.X does not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized data.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Mar 23, 2023 | n/a | Not reported |
Affected Products
2 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Jboss Enterprise Application PlatformRedhat | See advisory | 4.0 |
| JBoss | >= 4.x | n/a |
Patched Releases
Jboss Enterprise Application Platform
4.0
Timeline
Publicly disclosed
May 19, 2017
Added to Industry KEV feed
Mar 23, 2023
Last updated
May 12, 2026
Weakness Type
- CWE-502 Deserialization of Untrusted Data
References
- advisory98595
- exploitVulnCheck exploitation report
- exploitVulnCheck exploitation report
- exploitVulnCheck exploitation report
- otherbugzilla.redhat.com · show_bug.cgi
FAQ
Common Questions.
HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server <= Jboss 4.X does not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized data.
Affected: Jboss Enterprise Application Platform (Redhat); JBoss versions >= 4.x. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Mar 23, 2023.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Jboss Enterprise Application Platform 4.0.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2017-7504 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo