WildFly path traversal flaw allows SuperUser privilege escalation
A high-severity flaw in WildFly and JBoss EAP lets attackers with deployer roles traverse paths and escalate to SuperUser.
Key points
- CVE-2026-85634 is rated CVSS 8.8 HIGH severity.
- The flaw affects Red Hat Fuse 7, JBoss EAP 7, and JBoss EAP 8.
- The source material does not state whether a fix exists.
Red Hat Fuse 7, JBoss Enterprise Application Platform 7, and JBoss Enterprise Application Platform 8 are affected by a path traversal vulnerability. The flaw resides in the ContentRepositoryImpl.copyExplodedContent function within the wildfly-core library. This component manages server deployments for these enterprise application platforms. Attackers can exploit the issue to access files outside restricted directories. The source material does not state whether a fix exists.
How it unfolded
- The National Vulnerability Database recorded CVE-2026-85634 with a CVSS score of 8.8.
- The flaw was identified in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library.
- The vulnerability allows an attacker with the Deployer RBAC role to use path traversal sequences.
Who is affected
Organizations running Red Hat Fuse 7 are exposed to this risk. Customers using any version of Red Hat JBoss Enterprise Application Platform 7 are also affected. Those operating Red Hat JBoss Enterprise Application Platform 8 face the same threat. The vulnerability stems from how the library processes unsanitized deployment names. A missing containment check enables the exploitation of this flaw.
Our take on the response
The severity rating of 8.8 indicates a high risk of exploitation. The ability to escalate to the management SuperUser role is particularly dangerous. Attackers can delete arbitrary directories or create files with arbitrary content. This level of access could compromise the entire server environment. Teams must treat this as an urgent priority until a fix is available.
Who needs to act first
Managed service providers should prioritize systems with internet-facing deployment interfaces. Check whether any customer environments use the Deployer RBAC role. Restrict network access to management consoles where possible. Implement strict input validation for deployment names as a temporary control. Monitor logs for unusual file creation or deletion attempts. Isolate affected systems from sensitive data stores until a vendor update is released.
What to do and how to stay safe: WildFly
- Audit all WildFly and JBoss EAP instances for the Deployer RBAC role.
- Restrict network access to management interfaces to trusted IPs only.
- Monitor server logs for unauthorized file creation or deletion activities.
- Prepare to apply the vendor update once it becomes available.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this WildFly vulnerability?
The vulnerability is identified as CVE-2026-85634.
Which products are affected by this flaw?
Red Hat Fuse 7, JBoss EAP 7, and JBoss EAP 8 are affected.
Is there a patch available for this issue?
The source material does not state whether a fix exists.
