Red Hat Product Errata RHSA-2026:67604 - Security Advisory Issued: 2026-09-15 Updated: 2026-09-15 RHSA-2026:67604 - Security Advisory Overview Updated Packages Synopsis Important: Red Hat JBoss Enterprise Application Platform 7.4.25 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This asynchronous patch is a security update for Red Hat JBoss Enterprise Application Platform 7.4. Security Fix(es): artemis-server: Apache Artemis — session hijack via missing authentication (CVE-2026-57967) artemis-server: artemis core protocol permits unauthed queue creation (CVE-2026-49362) jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties (CVE-2026-59889) jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified (CVE-2026-54515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgements, and other related information, refer to the CVE page(s) listed in the References section. Solution Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Affected Products JBoss Enterprise Application Platform 7.4 ELS 7.4 for RHEL 9 x86_64 JBoss Enterprise Application Platform 7.4 ELS 7.4 for RHEL 8 x86_64 JBoss Enterprise Application Platform 7.4 ELS 7.4 for RHEL 7 x86_64 Fixes BZ - 2477945 - CVE-2026-49362 artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation BZ - 2480638 - CVE-2026-57967 artemis-server: Apache Artemis ? session hijack via missing authentication BZ - 2492016 - CVE-2026-54515 jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified BZ - 2500653 - CVE-2026-59889 com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties CVEs CVE-2026-49362 CVE-2026-54515 CVE-2026-57967 CVE-2026-59889 References https://access.redhat.com/security/updates/classification/#important https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4 https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index Note: More recent versions of these packages may be available. Click a package name for more details. JBoss Enterprise Application Platform 7.4 ELS 7.4 for RHEL 9 SRPM eap7-activemq-artemis-2.16.0-23.redhat_00058.1.el9eap.src.rpm SHA-256: 03e8c3712fbae08e504ed798e7e214c00ec306e02ee390cdc0927b3a8e142f9f eap7-jackson-annotations-2.18.9-1.redhat_00003.1.el9eap.src.rpm SHA-256: 2cf54911a5af86b2dd751c3eca42d0b2e58c504e3e2e3dd801edc2370452e58c eap7-jackson-core-2.18.9-1.redhat_00003.1.el9eap.src.rpm SHA-256: 7ee2aea45ca4ac7a81e429915cb210514edd13faa8a4bfc39520cd21de8a453f eap7-jackson-databind-2.18.9-1.redhat_00003.1.el9eap.src.rpm SHA-256: e940eaf2b9107f610995ae780dd0f2dd76069e174068c2b380fe47b2b6907d11 eap7-jackson-jaxrs-providers-2.18.9-1.redhat_00003.1.el9eap.src.rpm SHA-256: 9d0dd49288e86ab80ff97073ba7981decb4630d6af8a0ff3ac945a62793b3441 eap7-jackson-modules-base-2.18.9-1.redhat_00003.1.el9eap.src.rpm SHA-256: 5ac872360e8508d4dab4c7db5216ff4bf5bacc6d9418bfd149c888e0a67306a9 eap7-jackson-modules-java8-2.18.9-1.redhat_00003.1.el9eap.src.rpm SHA-256: 6472cd54764a8075239ea30798d4999020efce5e37afb12acfc7a7bc575df4de eap7-wildfly-7.4.25-6.GA_redhat_00005.1.el9eap.src.rpm SHA-256: 2ea90409ba6604ecbc6cb6d233d3ca493e9edc6f21c9490713f4a50cb4e27a0a x86_64 eap7-activemq-artemis-2.16.0-23.redhat_00058.1.el9eap.noarch.rpm SHA-256: 4932b751eecbacac7e42e7c971cc5730c0989dfc5bb35ddb5d4247a378f07bb0 eap7-activemq-artemis-cli-2.16.0-23.redhat_00058.1.el9eap.noarch.rpm SHA-256: 8ec56e9731a4b4f420feb12795b872208b4f7ae78e1a93dcab7b668b82b552c5 eap7-activemq-artemis-commons-2.16.0-23.redhat_00058.1.el9eap.noarch.rpm SHA-256: f549bd5e58ae5f77d303ea9058f457098fe2aa726044bf5fad300aa58a169a38 eap7-activemq-artemis-core-client-2.16.0-23.redhat_00058.1.el9eap.noarch.rpm SHA-256: d027f3439e22f3b400cceab9f849a5dfd59152327ffbc55472eeb3ffcf22a4c5 eap7-activemq-artemis-dto-2.16.0-23.redhat_00058.1.el9eap.noarch.rpm SHA-256: 6206e7e4ee6eca660a6548f1f1141cd37381bc3717735849d2ff42f9b4c65cfe eap7-activemq-artemis-hornetq-protocol-2.16.0-23.redhat_00058.1.el9eap.noarch.rpm SHA-256: 5b6102408f3d37fb087cbaac157fd6698136a296ca7b1545dc1915f027dcce46 eap7-activemq-artemis-hqclient-protocol-2.16.0-23.redhat_00058.1.el9eap.noarch.rpm SHA-256: bc7133175daa0c006f5f5093afedd1c6450a18123b935cd0335e88fd47a28b49 eap7-activemq-artemis-jdbc-store-2.16.0-23.redhat_00058.1.el9eap.noarch.rpm SHA-256: 4968fa8ffa5c6e02e2c2aa3a1842d75cc6451002979ec8b26be89849ce8ce91b eap7-activemq-artemis-jms-client-2.16.0-23.redhat_00058.1.el9eap.noarch.rpm SHA-256: 15c9fdc9a8a792c0fe07fe48f22792843d483e434bde2c5ca151441c0cce4aad eap7-activemq-artemis-jms-server-2.16.0-23.redhat_00058.1.el9eap.noarch.rpm SHA-256: 2a14634b83a42bea025cc1262547c998e7069cc76715223248928ee2d7f73337 eap7-activemq-artemis-journal-2.16.0-23.redhat_00058.1.el9eap.noarch.rpm SHA-256: f7f9280359451ca317cb0eaee8039cc7827ca174d6bfd70f5ba85423d50154b8 eap7-activemq-artemis-ra-2.16.0-23.redhat_00058.1.el9eap.noarch.rpm SHA-256: 7f903d24ddd6d0fd0fe5edddbaddba519897d5c004a1e57bc5a978c355d4d4dc eap7-activemq-artemis-selector-2.16.0-23.redhat_00058.1.el9eap.noarch.rpm SHA-256: c8d13ef6c118bfb21886e187c49bdb4f1a1e728dc598634b2270c4b917d86693 eap7-activemq-artemis-server-2.16.0-23.redhat_00058.1.el9eap.noarch.rpm SHA-256: c3316f987702fcf453c6e6be3f501e36be634a45bab07a68165ae249782ae448 eap7-activemq-artemis-service-extensions-2.16.0-23.redhat_00058.1.el9eap.noarch.rpm SHA-256: 1feb82cdb52c0c8b01ba31b2db28d083cadb0d8adf1013f3d4937bea6d73b0f2 eap7-activemq-artemis-tools-2.16.0-23.redhat_00058.1.el9eap.noarch.rpm SHA-256: fb0613f257f3ec02c22883b2739f63732daf974bca20d177cd5e6d4ade292c1d eap7-jackson-annotations-2.18.9-1.redhat_00003.1.el9eap.noarch.rpm SHA-256: bce97bdc0e52c66f6cb1bec53e9fc1165f681db7ee31db1ffa25536095b3812c eap7-jackson-core-2.18.9-1.redhat_00003.1.el9eap.noarch.rpm SHA-256: eb2ef8a10d9db878a25f4d01a85ffa3d3510d89aca07e12d6c0d954ce7f58a31 eap7-jackson-databind-2.18.9-1.redhat_00003.1.el9eap.noarch.rpm SHA-256: d5611ee766fcff2eeffd98b048f8ad5a9ebf0c733f0ca3344d29bbfef13a2f5b eap7-jackson-datatype-jdk8-2.18.9-1.redhat_00003.1.el9eap.noarch.rpm SHA-256: e4177f4e4dc0deb772f385006d3692337f42f3bb4c062a8bb77ec1e5e9f12490 eap7-jackson-datatype-jsr310-2.18.9-1.redhat_00003.1.el9eap.noarch.rpm SHA-256: 66a556607f11610381c22751b7e9c57ce6f18bf96fcab53d790722afe87e3294 eap7-jackson-jaxrs-base-2.18.9-1.redhat_00003.1.el9eap.noarch.rpm SHA-256: b75dd07d1557ac71ffd4bf8cf171dbd88fff901f11d48f991f07c0f77fceeb8f eap7-jackson-jaxrs-json-provider-2.18.9-1.redhat_00003.1.el9eap.noarch.rpm SHA-256: ea0bc185b3f9d35e9328f305872294f51e2d1431e30d8a897d5bae4a33059d59 eap7-jackson-module-jaxb-annotations-2.18.9-1.redhat_00003.1.el9eap.noarch.rpm SHA-256: 7606f15ea697f55d735f9a1f17ced5b47d4c16cb9a96c8a64cfcc6f60746346c eap7-jackson-modules-base-2.18.9-1.redhat_00003.1.el9eap.noarch.rpm SHA-256: d39e78b4033c7ae7cce2b66edeb837fddba5fdc9d02a1422b235647823ad24cf eap7-jackson-modules-java8-2.18.9-1.redhat_00003.1.el9eap.noarch.rpm SHA-256: 9759087f41070cfe78be918c0a3c9d20c44e09854ec6195768effffa0c7292f2 eap7-wildfly-7.4.25-6.GA_redhat_00005.1.el9eap.noarch.rpm SHA-256: f229b9526245d202d05135a95f8966f87bb1d2c10087c04a37beebf226e98cb5 eap7-wildfly-java-jdk11-7.4.25-6.GA_redhat_00005.1.el9eap.noarch.rpm SHA-256: 8bb0cddffc3d04ec029c7a6842d75d0b5293a16a99de024e71208991573d38c2 eap7-wildfly-java-jdk17-7.4.25-6.GA_redhat_00005.1.el9eap.noarch.rpm SHA-256: 9624afdd70fad4c68c4b26a83e615970e1c5d333dc459e6846c729700e5c91dc eap7-wildfly-java-jdk8-7.4.25-6.GA_redhat_00005.1.el9eap.noarch.rpm SHA-256: 6e75f72cca0902c655094890079b3ee24a685d51087e80e41476ca10722be31e eap7-wildfly-modules-7.4.25-6.GA_redhat_00005.1.el9eap.noarch.rpm SHA-256: b0db77c2161b28c9c40c3fa73af7871db5ce30343557cdea2482e2210627f0ba JBoss Enterprise Application Platform 7.4 ELS 7.4 for RHEL 8 SRPM eap7-activemq-artemis-2.16.0-23.redhat_00058.1.el8eap.src.rpm SHA-256: 1fa8517ce725b9d7caf93766ed725bebfab4107b2de285c9d5e1a9ed371981ec eap7-jackson-annotations-2.18.9-1.redhat_00003.1.el8eap.src.rpm SHA-256: 7b1487885bd80ecc2c59905fecdf80084c22bb912ef5f5308aef2aa20e07fbe9 eap7-jackson-core-2.18.9-1.redhat_00003.1.el8eap.src.rpm SHA-256: 17ec8af5a01723d55fb08f9871a5b925022e719666f301ea0ba2b1e5a13bc646 eap7-jackson-databind-2.18.9-1.redhat_00003.1.el8eap.src.rpm SHA-256: c7c79439c8448399b749757b1706b4781c01751a215a8969d0f2d6ba39c225b2 eap7-jackson-jaxrs-providers-2.18.9-1.redhat_00003.1.el8eap.src.rpm SHA-256: 28f09e0e901b38dd0a36f642b0c405038d0ba308a78c1408fa42c185669ff7bd eap7-jackson-modules-base-2.18.9-1.redhat_00003.1.el8eap.src.rpm SHA-256: 743127c80b67ae6f93c1071d99577b0c4949d671b178b5e3927dd18356284481 eap7-jackson-modules-java8-2.18.9-1.redhat_00003.1.el8eap.src.rpm SHA-256: 06ddd117780b781c7b7e0d27a7926cea56288424ba04e8ea9f4b7382ce65c797 eap7-wildfly-7.4.25-6.GA_redhat_00005.1.el8eap.src.rpm SHA-256: 38071fc528716062c0232df67116ef51cdda7a6bf99408c8fc45f9a