A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://access.redhat.com/security/cve/CVE-2025-23368 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2337621 Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.1 · redhatNVD modified 2026-10-14 17:17
Affected (CPE criteria) 4
cpe:2.3:a:redhat:wildfly_core:*:*:*:*:*:*:*:*cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:*
References 7
- https://access.redhat.com/errata/RHSA-2026:18054
- https://access.redhat.com/errata/RHSA-2026:18055
- https://access.redhat.com/errata/RHSA-2026:18059
- https://access.redhat.com/errata/RHSA-2026:33371
- https://access.redhat.com/security/cve/CVE-2025-23368 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2337621 Vendor Advisory
- https://www.gruppotim.it/it/footer/red-team.html Exploit, Third Party Advisory