PlatformPlansPartners
Resources
ToolsBlogDocs
Labs
CVE ForecastOpservantAll Research →
Sign Up →
critical·Product Based Web Vulnerabilities·Updated Aug 25, 2026

JBossMQ HTTP Invocation Layer (HTTPServerILServlet) - Unauthenticated Java Deserialization

Est. Time~10 seconds
Scan TypeGroup Scan
Targetsurl
CostFree
5
Times Used
continuous scan runs
0
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
CVECVE-2017-7504
9.8
CVSS

HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server <= Jboss 4.X does not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized data.

Attack Vector
-
Privileges Req.
-
User Interaction
-
Affected
JBossby Red Hat, Inc.
4.x
Updated Sep 9, 2026View on NVD →
Similar Tools
critical
NVIDIA Triton Inference Server <= 26.02 - Authentication Bypass
→low
Wordpress Denial of Service Scanner
→high
Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS
→critical
Metabase - Remote Code Execution (Apache Log4j)
→high
Apache Tomcat WebSocket Frame Payload Length Validation Denial of Service Scanner
→high
CVE-2020-16139 Scanner
→

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

JBossMQ HTTP Invocation Layer (HTTPServerILServlet) - Unauthenticated Java Deserialization CVE-2017-7504 Scanner | S4E