Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Dat…

CheckOps priority index

6.3/10 Patch within 7 days

Severity—

Probability8.6

Exploitation2/5

Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.

EPSS · today 85.6% higher than 99.7% of CVEs

CVSS — not published

Exploited for 478 days 14 Jul 2025

Fixed packages 1 / 1 in open source registries

Exploitation probability EPSS · FIRST

EPSS probability (%)Percentile among all CVEs

Exploitation signals 2 / 5

KEV catalog (CISA)no
Exploited in EUVD (ENISA)14 Jul 2025
Used by ransomwareno
EPSS above 10 %85.6%
No account, over the networkunknown

What to do

Fix

Update to a fixed version: 4.1

Meanwhile

Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.

Manufacturers (CRA)

Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained

Description ENISA EUVD

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Affected products

The sources do not list the affected products yet.

Open source packages OSV

org.apache.commons:commons-collections4Maven · GHSA-fjq5-5j5f-mvxh
fixed in 4.1

Timeline

09 Nov 2017
Published
14 Jul 2025
Exploitation reported (ENISA)
26 Sept 2026
EPSS peak: 85.6%