CVE-2015-6420
Insecure Deserialization in Apache Commons Collection
Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
- Record
CVE-2015-6420- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-502
- Updated
- 2026-11-02
CVE List
Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
- Record
CVE-2015-6420- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2020-0464
Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
- Record
EUVD-2020-0464- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6hgm-866r-3cjv No score
Insecure Deserialization in Apache Commons Collection
Serialized-object interfaces in Java applications using the Apache Commons Collections (ACC) library may allow remote attackers to execute arbitrary commands via a crafted serialized Java object.
- Record
GHSA-6hgm-866r-3cjv- Weakness
- CWE-502
- Updated
- 2026-11-02
OSVCLSA-2026-1777509604 No score
TuxCare security update for commons-collections:commons-collections (1 CVE)
TuxCare rebuilt commons-collections:commons-collections to address 1 CVE. Fixed in 3.2.1-tuxcare.1.
- Record
CLSA-2026-1777509604- Updated
- 2026-11-02
OSVCLSA-2026-1778114665 No score
TuxCare security update for commons-collections:commons-collections (1 CVE)
TuxCare rebuilt commons-collections:commons-collections to address 1 CVE. Fixed in 3.2-tuxcare.1.
- Record
CLSA-2026-1778114665- Updated
- 2026-11-02
OSVCLSA-2026-1789362482 No score
TuxCare security update for commons-collections:commons-collections (2 CVEs)
TuxCare rebuilt commons-collections:commons-collections to address 2 CVEs. Fixed in 3.1-tuxcare.1.
- Record
CLSA-2026-1789362482- Updated
- 2026-11-05
OSVGHSA-6hgm-866r-3cjv No score
Insecure Deserialization in Apache Commons Collection
Serialized-object interfaces in Java applications using the Apache Commons Collections (ACC) library may allow remote attackers to execute arbitrary commands via a crafted serialized Java object.
- Record
GHSA-6hgm-866r-3cjv- Weakness
- CWE-502
- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2015-6420 No score
CVE-2015-6420 in commons-collections:commons-collections - Patched by Root
Root has patched CVE-2015-6420 in the commons-collections:commons-collections package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2015-6420- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.commons:commons-collections4Maven |
before 4.1 | 4.1 |
commons-collections:commons-collectionsMaven |
before 3.2.2 | 3.2.2 |
net.sourceforge.collections:collections-genericMaven |
through 4.0.1 | None known |
org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-genericMaven |
through 4.01 | None known |
org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collectionsMaven |
through 3.2.1 | None known |
commons-collections:commons-collectionsTuxCare:Maven |
3.2.1 up to 3.2.1-tuxcare.1 | 3.2.1-tuxcare.1 |
commons-collections:commons-collectionsTuxCare:Maven |
3.2 up to 3.2-tuxcare.1 | 3.2-tuxcare.1 |
commons-collections:commons-collectionsTuxCare:Maven From an advisory covering 2 CVEs |
3.1 up to 3.1-tuxcare.1 | 3.1-tuxcare.1 |
org.apache.commons:commons-collections4Maven |
before 4.1, plus listed versions 4.0 |
4.1 |
commons-collections:commons-collectionsMaven |
before 3.2.2, plus listed versions 1.02.02.0.20020914.0159532.0.20020914.0207462.0.20020914.020858 Show 7 moreShow less2.12.1.13.03.0-dev23.13.23.2.1 |
3.2.2 |
commons-collections:commons-collectionsRoot:Maven |
before 2.0-aikido.2 | 2.0-aikido.23.1-aikido.32.1-aikido.23.2-aikido.23.2.1-aikido.33.2.1-aikido.4 |
io.root.commons-collections:commons-collectionsRoot:Maven |
before 2.1-root.io.1 | 2.1-root.io.12.0-root.io.13.2-root.io.13.1-root.io.23.2.1-root.io.22.0-root.io.23.1-root.io.32.1-root.io.23.2-root.io.23.2.1-root.io.33.2.1-root.io.4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | Leeziao/CVE-2015-6420 | 2025-04-16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-6420 is a critical vulnerability (CVSS 9.8) in Apache Commons Collections, published December 15, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 24.2%, the 97th percentile. Fixed in org.apache.commons:commons-collections4 4.1.
References
oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization
securityfocus.com/bid/78872
tenable.com/security/research/tra-2017-23
Show 11 moreShow less
kb.cert.org/vuls/id/581311
lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21%40%3Ccommits.samza.apache.org%3E
foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability
news.apache.org/foundation/entry/apache_commons_statement_to_widespread
nvd.nist.gov/vuln/detail/CVE-2015-6420
arxiv.org/pdf/2306.05534
github.com/advisories/GHSA-6hgm-866r-3cjv