WaratekVRT Sign in

CVE-2015-7501

Affected software15 products, listed below
Severity9.8 Critical CVSS 3.0 2 scores
Fixed in3.2.2
WeaknessDeserialization of untrusted data (CWE-502)
Published9 Nov 2017
Updated13 Nov 2026

Description

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 2 citations · 2 exploits · earliest 2016-01-28.
  • CISA Vulnrichment no assessment published
  • Indexed PoC 2 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2020-02-21.
  • EPSS 86% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.7% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2015-7501 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation proofpoint.com /us/threat-insight/post/exploring-bergard-old-malware-new-tricks 2016-01-28
Reported exploitation acn.gov.it /portale/w/distribuzione-di-payload-malevoli-tramite-vulnerabilita-note 2025-07-14
Exploit reference VulnCheck XDB 1b29e476b51f Exploit type: initial-access 2023-05-25
Exploit reference VulnCheck XDB 944b1b1e56ff Exploit type: initial-access 2024-10-21
IndexArtifactStarsFirst seen
GitHub PoC （CVE-2015-7501）JBoss JMXInvokerServlet 反序列化漏洞 22 2020-02-21
Nuclei Red Hat JBoss - Insecure Deserialization

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR Deserial sys rule, Marshal RCE rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: Deserial sys rule, Marshal RCE rule

  • It was found that a flaw in commons-collection library allowed remote code execution wherever deserialization occurs. While JBoss doesnt expose the JMXInvokerServlet by default other interfaces where deserialization occur might be vulnerable. Note: classes directly referenced by this flaw: InvokerTransformer InstantiateFactory and InstantiateTransformer External References: http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ https://access.redhat.com/solutions/2045023. Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x 5.x and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object related to the Apache Commons Collections (ACC) library.

How to mitigate CVE-2015-7501

Upgrade the affected software to 3.2.2 or later. Until you can, Waratek RASP blocks exploitation with its deserialization rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 10.0 none AV:N/AC:L/Au:N/C:C/I:C/A:C NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2020 ↗ CPU 2020-Q3 Oracle Supply Chain / Middle Tier (Apache Commons Collections) (12.1, 12.2)
Oracle Critical Patch Update October 2018 ↗ CPU 2018-Q4 Oracle Communications Applications / Security (Apache Commons Collections) (Prior to 10.2.1)
Oracle Communications Applications / Security (Apache Commons Collections) (Prior to 3.7.1M0)
Oracle Critical Patch Update July 2018 ↗ CPU 2018-Q3 Oracle Sun Systems Products Suite / Software (Apache Commons Collections) (Prior to ACSLS 8.4.0-3)
Oracle Critical Patch Update April 2018 ↗ CPU 2018-Q2 Oracle Enterprise Manager Products Suite / EM Plugin: General (Apache Commons Collections) (12.1.0.4)
Oracle Fusion Middleware / - (Apache Commons Collections) (10.3.6.0.0)
Oracle Fusion Middleware / Configuration (Apache Commons Collections) (3.2.0.0.0)
Oracle Fusion Middleware / None (Apache Commons Collections) (11.2.0.1.2, 12.1.3.0.0)
Oracle Fusion Middleware / Security (Apache Commons Collections) (11.1.1.7.0, 11.1.1.9.0)
Oracle Critical Patch Update January 2018 ↗ CPU 2018-Q1 Oracle Fusion Middleware / CA ACF2 (Apache Commons Collections) (9.0.4.20.6, 9.0.4.21.0, 9.0.4.25.4)
Oracle Fusion Middleware / Security (Apache Commons Collections) (11.1.2.3.0)
Oracle Critical Patch Update October 2017 ↗ CPU 2017-Q4 Oracle Communications Applications / Security (Apache Commons Collections) (7.0, 7.1, 7.2)
Oracle Communications Applications / Security (Apache Commons Collections) (7.2.4.x.x, 7.3.0.x.x, 7.3.1.x.x, 7.3.5.x.x)
Oracle Fusion Middleware / Monitor (Apache Commons Collections) (11.2.1.0.12)
Oracle Fusion Middleware / Security (Apache Commons Collections) (11.1.1.9.0, 12.2.1.1.0)
Oracle Fusion Middleware / Security (Apache Commons Collections) (2.4, 3.0, 3.1, 3.2)
Oracle Supply Chain Products Suite / Install (Apache Commons Collections) (6.1.3, 6.2.0)
Oracle Critical Patch Update July 2017 ↗ CPU 2017-Q3 Oracle Communications Applications / Elastic Charging Engine (Apache Commons Collections) (11.2.0.0.0)
Oracle Fusion Middleware / Core (Apache Commons Collections) (7.6.0.0, 7.6.1.0)
Oracle Fusion Middleware / General (Apache Commons Collections) (11.1.1.2.0, 11.1.1.2.1, 11.1.1.2.2, 12.1.1.1.0, 12.1.3.0.0)
Oracle Fusion Middleware / General (Apache Commons Fileupload) (8.1.13.0.0)
Oracle Fusion Middleware / Security (12.1.3.0.0)
Oracle Fusion Middleware / Studio (11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, 12.2.1.0.0)
Oracle Critical Patch Update April 2017 ↗ CPU 2017-Q2 Oracle Fusion Middleware / Install (Apache Commons Collections) (11.1.1.9, 12.2.1.1, 12.2.1.2)
Oracle Fusion Middleware / Sites (Apache Commons Collections) (11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0, 12.2.1.2.0)
Oracle Sun Systems Products Suite / Core (Apache Commons Collections) (Prior to 2.2.1)
Oracle Critical Patch Update January 2017 ↗ CPU 2017-Q1 Oracle Communications Applications / Oracle Communications Network Intelligence (7.3.0.0)
Oracle Financial Services Applications / Oracle FLEXCUBE Direct Banking (12.0.0, 12.0.1, 12.0.2, 12.0.3)
Oracle Fusion Middleware / Oracle Fusion Middleware (11.1.1.7, 11.1.1.9)
Oracle MySQL / MySQL Enterprise Monitor (3.1.5.7958 and earlier, 3.2.1.1049 and earlier,)
Oracle Retail Applications / Oracle Retail Allocation (12.0, 13.0, 13.1, 13.2, 13.3, 14.0, 14.1)
Oracle Retail Applications / Oracle Retail Assortment Planning (14.1, 15.0)
Oracle Retail Applications / Oracle Retail Price Management (13.1, 13.2, 14.0, 14.1)
Oracle Critical Patch Update October 2016 ↗ CPU 2016-Q4 Oracle Big Data Graph / Apache Commons Collections (Prior to 1.2)
Oracle Commerce / Content Acquisition System (3.1.1, 3.1.2, 11.0, 11.1, 11.2)
Oracle Financial Services Applications / Apache Commons Collections (11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0)
Oracle Financial Services Applications / Apache Commons Collections (11.5.0.0.0, 11.6.0.0.0)
Oracle Financial Services Applications / Apache Commons Collections (12.0.0, 12.1.0)
Oracle Financial Services Applications / Apache Commons Collections (12.0.1)
Oracle Financial Services Applications / Apache Commons Collections (12.87.1, 12.87.2)
Oracle Financial Services Applications / Apache Commons Collections (14.1.0, 14.2.0)
Oracle Financial Services Applications / Apache Commons Collections (15.1)
Oracle Financial Services Applications / Apache Commons Collections (2.0.0, 2.0.1, 2.2.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0)
Oracle Financial Services Applications / Apache Commons Collections (7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 8.0.0, 8.0.1, 8.0.2, 8.0.3)
Oracle Fusion Middleware / None (10.3.6.0, 12.1.3.0, 12.2.1.0)
Oracle Insurance Applications / Apache Commons Collections (4.3.2)
Oracle Retail Applications / General Application (13.2, 13.3, 13.4, 14.0)
Oracle Retail Applications / Liferay (7.0.2, 7.0.4)
Oracle Retail Applications / Xenvironment (5.0, 5.5, 6.0, 6.5, 7.0, 7.1)
Oracle Supply Chain Products Suite / Apache Commons Collections (9.3.4, 9.3.5)
Oracle Virtualization / Apache Commons Collection (VDI prior to 3.5.3)
Oracle Critical Patch Update July 2016 ↗ CPU 2016-Q3 Oracle Communications Applications / Service request translator (7.0, 7.2, 7.3)
Oracle Enterprise Manager Grid Control / Enterprise Controller Install (12.1.4, 12.2.2, 12.3.2)
Oracle Financial Services Applications / Rules collections (2.3.0, 2.4.0, 2.4.1)
Oracle Health Sciences Applications / Installation and configuration (3.1.1.x, 3.1.2.x)
Oracle Health Sciences Applications / Self Service Analytics (3.1.0.0.0)
Oracle Insurance Applications / Architecture (9.6.1, 9.7.1, 10.0.1, 10.1.2, 10.2.0, 10.2.2)
Oracle Insurance Applications / Architecture (9.6.1, 9.7.1, 10.0.1, 10.1.2, 10.2.0, 10.2.2)
Oracle Insurance Applications / Architecture (9.7.1, 10.1.2, 10.2.2)
Oracle Insurance Applications / Development tools (Prior to 12.5)
Oracle Policy Automation / Analysis Server (12.0.1)
Oracle Policy Automation / Determinations Engine (10.3.0, 10.3.1, 10.4.0, 10.4.1, 10.4.2, 10.4.3, 10.4.4, 10.4.5, 10.4.6, 12.1.0, 12.1.1)
Oracle Policy Automation / Determinations Server (10.3.0, 10.4.0, 10.4.1, 10.4.2, 10.4.3, 10.4.4, 10.4.5, 10.4.6)
Oracle Policy Automation / Mobile Application (12.1.1)
Oracle Primavera Products Suite / PCM application (14.2)
Oracle Primavera Products Suite / Web access (8.2, 8.3, 8.4, 15.1, 15.2, 16.1)
Oracle Retail Applications / Install (12.0 13.0, 13.1, 13.2, 13.3, 13.4, 14.0, 14.1)
Oracle Retail Applications / Install (15.0)
Oracle Retail Applications / Retail (10.0.1, 10.5.0, 10.6.0, 10.7.0, 10.8.0, 10.8.1)
Oracle Retail Applications / SIMINT (12.0, 13.0, 13.1, 13.2, 14.0, 14.1)
Oracle Supply Chain Products Suite / Web Container (6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4.0, 6.4.1)
Oracle Utilities Applications / Integrations (1.9.1.2.8)
Oracle Utilities Applications / System wide (1.10.0.6.27, 1.11.0.4.41, 1.11.0.5.4, 1.12.0.1.16, 1.12.0.2.12. 1.12.0.3.5)
Oracle Utilities Applications / System wide (2.2.0.0.0, 4.1.0.1.0, 4.1.0.2.0, 4.2.0.1.0, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0, 4.3.0.2.0)
Oracle Critical Patch Update April 2016 ↗ CPU 2016-Q2 Oracle Enterprise Manager Grid Control / Install (12.4.0.2, 12.5.0.2)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Big Data Graph Apache Commons Collections Prior to 1.2
Oracle Commerce Content Acquisition System 3.1.1, 3.1.2, 11.0, 11.1, 11.2 3.1.1 · 3.1.2 · 11.0 · 11.1 · 11.2
Oracle Communications Applications Elastic Charging Engine (Apache Commons Collections) 11.2.0.0.0 11.2.0.0.0
Oracle Communications Applications Oracle Communications Network Intelligence 7.3.0.0 7.3.0.0
Oracle Communications Applications Security (Apache Commons Collections) Prior to 3.7.1M0 7.0 · 7.1 · 7.2 · 7.2.4 · 7.3.0 · 7.3.1 · 7.3.5
Oracle Communications Applications Service request translator 7.0, 7.2, 7.3 7.0 · 7.2 · 7.3
Oracle Enterprise Manager Grid Control Enterprise Controller Install 12.1.4, 12.2.2, 12.3.2 12.1.4 · 12.2.2 · 12.3.2
Oracle Enterprise Manager Grid Control Install 12.4.0.2, 12.5.0.2 12.4.0.2 · 12.5.0.2
Oracle Enterprise Manager Products Suite EM Plugin: General (Apache Commons Collections) 12.1.0.4 12.1.0.4
Oracle Financial Services Applications Apache Commons Collections 2.0.0, 2.0.1, 2.2.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 2.0.0 · 2.0.1 · 2.2.0 · 7.3.0 · 7.3.1 · 7.3.2 · 7.3.3 · 7.3.4 · 7.3.5 · 8.0.0 · 8.0.1 · 8.0.2 · 8.0.3 · 11.3.0 · 11.4.0 · 11.5.0.0.0 · 11.6.0.0.0 · 12.0.0 · 12.0.1 · 12.0.2 · 12.0.3 · 12.1.0 · 12.2.0 · 12.87.1 · 12.87.2 · 14.1.0 · 14.2.0 · 15.1
Oracle Financial Services Applications Oracle FLEXCUBE Direct Banking 12.0.0, 12.0.1, 12.0.2, 12.0.3 12.0.0 · 12.0.1 · 12.0.2 · 12.0.3
Oracle Financial Services Applications Rules collections 2.3.0, 2.4.0, 2.4.1 2.3.0 · 2.4.0 · 2.4.1
Oracle Fusion Middleware - (Apache Commons Collections) 10.3.6.0.0 10.3.6.0.0
Oracle Fusion Middleware CA ACF2 (Apache Commons Collections) 9.0.4.20.6, 9.0.4.21.0, 9.0.4.25.4 9.0.4.20.6 · 9.0.4.21.0 · 9.0.4.25.4
Oracle Fusion Middleware Configuration (Apache Commons Collections) 3.2.0.0.0 3.2.0.0.0
Oracle Fusion Middleware Core (Apache Commons Collections) 7.6.0.0, 7.6.1.0 7.6.0.0 · 7.6.1.0
Oracle Fusion Middleware General (Apache Commons Collections) 11.1.1.2.0, 11.1.1.2.1, 11.1.1.2.2, 12.1.1.1.0, 12.1.3.0.0 11.1.1.2.0 · 11.1.1.2.1 · 11.1.1.2.2 · 12.1.1.1.0 · 12.1.3.0.0
Oracle Fusion Middleware General (Apache Commons Fileupload) 8.1.13.0.0 8.1.13.0.0
Oracle Fusion Middleware Install (Apache Commons Collections) 11.1.1.9, 12.2.1.1, 12.2.1.2 11.1.1.9 · 12.2.1.1 · 12.2.1.2
Oracle Fusion Middleware Monitor (Apache Commons Collections) 11.2.1.0.12 11.2.1.0.12
Oracle Fusion Middleware None 10.3.6.0, 12.1.3.0, 12.2.1.0 10.3.6.0 · 12.1.3.0 · 12.2.1.0
Oracle Fusion Middleware None (Apache Commons Collections) 11.2.0.1.2, 12.1.3.0.0 11.2.0.1.2 · 12.1.3.0.0
Oracle Fusion Middleware Oracle Fusion Middleware 11.1.1.7, 11.1.1.9 11.1.1.7 · 11.1.1.9
Oracle Fusion Middleware Security 12.1.3.0.0 12.1.3.0.0
Oracle Fusion Middleware Security (Apache Commons Collections) 2.4, 3.0, 3.1, 3.2 2.4 · 3.0 · 3.1 · 3.2 · 11.1.1.7.0 · 11.1.1.9.0 · 11.1.2.3.0 · 12.2.1.1.0
Oracle Fusion Middleware Sites (Apache Commons Collections) 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0, 12.2.1.2.0 11.1.1.8.0 · 12.2.1.0.0 · 12.2.1.1.0 · 12.2.1.2.0
Oracle Fusion Middleware Studio 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, 12.2.1.0.0 11.1.1.7.0 · 11.1.1.9.0 · 12.1.3.0.0 · 12.2.1.0.0
Oracle Health Sciences Applications Installation and configuration 3.1.1.x, 3.1.2.x 3.1.1 · 3.1.2
Oracle Health Sciences Applications Self Service Analytics 3.1.0.0.0 3.1.0.0.0
Oracle Insurance Applications Apache Commons Collections 4.3.2 4.3.2
Oracle Insurance Applications Architecture 9.6.1, 9.7.1, 10.0.1, 10.1.2, 10.2.0, 10.2.2 9.6.1 · 9.7.1 · 10.0.1 · 10.1.2 · 10.2.0 · 10.2.2
Oracle Insurance Applications Development tools Prior to 12.5
Oracle MySQL MySQL Enterprise Monitor 3.1.5.7958 and earlier, 3.2.1.1049 and earlier,
Oracle Policy Automation Analysis Server 12.0.1 12.0.1
Oracle Policy Automation Determinations Engine 10.3.0, 10.3.1, 10.4.0, 10.4.1, 10.4.2, 10.4.3, 10.4.4, 10.4.5, 10.4.6, 12.1.0, 12.1.1 10.3.0 · 10.3.1 · 10.4.0 · 10.4.1 · 10.4.2 · 10.4.3 · 10.4.4 · 10.4.5 · 10.4.6 · 12.1.0 · 12.1.1
Oracle Policy Automation Determinations Server 10.3.0, 10.4.0, 10.4.1, 10.4.2, 10.4.3, 10.4.4, 10.4.5, 10.4.6 10.3.0 · 10.4.0 · 10.4.1 · 10.4.2 · 10.4.3 · 10.4.4 · 10.4.5 · 10.4.6
Oracle Policy Automation Mobile Application 12.1.1 12.1.1
Oracle Primavera Products Suite PCM application 14.2 14.2
Oracle Primavera Products Suite Web access 8.2, 8.3, 8.4, 15.1, 15.2, 16.1 8.2 · 8.3 · 8.4 · 15.1 · 15.2 · 16.1
Oracle Retail Applications General Application 13.2, 13.3, 13.4, 14.0 13.2 · 13.3 · 13.4 · 14.0
Oracle Retail Applications Install 12.0 13.0, 13.1, 13.2, 13.3, 13.4, 14.0, 14.1 12.0.13.0 · 13.1 · 13.2 · 13.3 · 13.4 · 14.0 · 14.1 · 15.0
Oracle Retail Applications Liferay 7.0.2, 7.0.4 7.0.2 · 7.0.4
Oracle Retail Applications Oracle Retail Allocation 12.0, 13.0, 13.1, 13.2, 13.3, 14.0, 14.1 12.0 · 13.0 · 13.1 · 13.2 · 13.3 · 14.0 · 14.1
Oracle Retail Applications Oracle Retail Assortment Planning 14.1, 15.0 14.1 · 15.0
Oracle Retail Applications Oracle Retail Price Management 13.1, 13.2, 14.0, 14.1 13.1 · 13.2 · 14.0 · 14.1
Oracle Retail Applications Retail 10.0.1, 10.5.0, 10.6.0, 10.7.0, 10.8.0, 10.8.1 10.0.1 · 10.5.0 · 10.6.0 · 10.7.0 · 10.8.0 · 10.8.1
Oracle Retail Applications SIMINT 12.0, 13.0, 13.1, 13.2, 14.0, 14.1 12.0 · 13.0 · 13.1 · 13.2 · 14.0 · 14.1
Oracle Retail Applications Xenvironment 5.0, 5.5, 6.0, 6.5, 7.0, 7.1 5.0 · 5.5 · 6.0 · 6.5 · 7.0 · 7.1
Oracle Sun Systems Products Suite Core (Apache Commons Collections) Prior to 2.2.1
Oracle Sun Systems Products Suite Software (Apache Commons Collections) Prior to ACSLS 8.4.0-3
Oracle Supply Chain Middle Tier (Apache Commons Collections) 12.1, 12.2 12.1 · 12.2
Oracle Supply Chain Products Suite Apache Commons Collections 9.3.4, 9.3.5 9.3.4 · 9.3.5
Oracle Supply Chain Products Suite Install (Apache Commons Collections) 6.1.3, 6.2.0 6.1.3 · 6.2.0
Oracle Supply Chain Products Suite Web Container 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4.0, 6.4.1 6.3.0 · 6.3.1 · 6.3.2 · 6.3.3 · 6.3.4 · 6.3.5 · 6.3.6 · 6.3.7 · 6.4.0 · 6.4.1
Oracle Utilities Applications Integrations 1.9.1.2.8 1.9.1.2.8
Oracle Utilities Applications System wide 1.10.0.6.27, 1.11.0.4.41, 1.11.0.5.4, 1.12.0.1.16, 1.12.0.2.12. 1.12.0.3.5 1.10.0.6.27 · 1.11.0.4.41 · 1.11.0.5.4 · 1.12.0.1.16 · 1.12.0.2.12.1 · 2.2.0.0.0 · 4.1.0.1.0 · 4.1.0.2.0 · 4.2.0.1.0 · 4.2.0.2.0 · 4.2.0.3.0 · 4.3.0.1.0 · 4.3.0.2.0
Oracle Virtualization Apache Commons Collection VDI prior to 3.5.3 3.5.3

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
commons-collections:commons-collections 0 3.2.2 unbounded
org.apache.commons:commons-collections4 0 4.1 unbounded
org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections 3.2.1 none unbounded
net.sourceforge.collections:collections-generic unspecified none unbounded
org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic 4.01 none unbounded

Products and versions

20 products, 24 version entries
SourceVendorProductSchemeAffected versions
osv commons-collections commons-collections generic ＜ 3.2.2
osv net.sourceforge.collections collections-generic generic any version
osv org.apache.commons commons-collections4 generic ＜ 4.1
osv org.apache.servicemix.bundles org.apache.servicemix.bundles.collections-generic generic ≥ 4.1
osv org.apache.servicemix.bundles org.apache.servicemix.bundles.commons-collections generic ≥ 3.2.1
nvd redhat data grid generic 6.0.0
nvd redhat jboss a-mq generic 6.0.0
nvd redhat jboss bpm suite generic 6.0.0
nvd redhat jboss data virtualization generic 5.0.0 · 6.0.0
nvd redhat jboss enterprise application platform generic 4.3.0 · 5.0.0 · 6.0.0
nvd redhat jboss enterprise brms platform generic 5.0.0 · 6.0.0
nvd redhat jboss enterprise soa platform generic 5.0.0
nvd redhat jboss enterprise web server generic 3.0.0
nvd redhat jboss fuse generic 6.0.0
nvd redhat jboss fuse service works generic 6.0
nvd redhat jboss operations network generic 3.0
nvd redhat jboss portal generic 6.0.0
nvd redhat openshift generic 3.0
nvd redhat subscription asset manager generic 1.3.0
nvd redhat xpaas generic 3.0.0

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** HTTP, T3, APACHE COMMONS COLLECTION, APACHE COMMONS COLLECTIONS **Products:** APACHE-COMMONS-COLLECTIONS

References

URLTags
https://access.redhat.com/security/vulnerabilities/2059393 WEB
https://access.redhat.com/solutions/2045023 WEB
https://arxiv.org/pdf/2306.05534.pdf WEB
https://bugzilla.redhat.com/show_bug.cgi?id=1279330 WEB
https://commons.apache.org/proper/commons-collections/release_4_1.html WEB
https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability WEB
https://github.com/apache/commons-collections PACKAGE
https://github.com/jensdietrich/xshady-release/tree/main/CVE-2015-7501 WEB
https://issues.apache.org/jira/browse/COLLECTIONS-580. WEB
https://sourceforge.net/p/collections/code/HEAD/tree WEB

Timeline
VulnCheck KEV: earliest evidence2016-01-28Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Published2017-11-09By the CVE Program.
VulnCheck KEV: latest evidence2025-07-14Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.