CVE-2015-7501

Deserialization of Untrusted Data in Apache commons collections

9.8 CriticalKnown exploitedPublic exploitFix available

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

85.6%Up 43.5 points since Feb 4, 2022

What each source reports

NVD Score used 9.8

Record: CVE-2015-7501
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-502
Updated: 2026-11-02

CVE List No score

Record: CVE-2015-7501
Updated: 2026-11-02

EUVDEUVD-2022-3799 No score

Record: EUVD-2022-3799
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fjq5-5j5f-mvxh 9.8

Deserialization of Untrusted Data in Apache commons collections

It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.

Record: GHSA-fjq5-5j5f-mvxh
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSV 9.8

Record: CVE-2015-7501
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2015-7501 9.8

Record: DEBIAN-CVE-2015-7501
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 8 moreShow less

OSVGHSA-fjq5-5j5f-mvxh 9.8

Deserialization of Untrusted Data in Apache commons collections

Record: GHSA-fjq5-5j5f-mvxh
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSVRHSA-2015:2523 7.5

Red Hat Security Advisory: rh-java-common-apache-commons-collections security update

Record: RHSA-2015:2523
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2016:1773 4.8

Red Hat Security Advisory: Red Hat OpenShift Enterprise 2.2.10 security, bug fix, and enhancement update

Record: RHSA-2016:1773
CVSS 3.0: 4.8 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated: 2026-11-02

OSVRHSA-2020:4274 7.5

Red Hat Security Advisory: rh-maven35-apache-commons-collections4 security update

Record: RHSA-2020:4274
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-7501 9.8

Record: UBUNTU-CVE-2015-7501
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVCLSA-2026-1789362482 No score

TuxCare security update for commons-collections:commons-collections (2 CVEs)

TuxCare rebuilt commons-collections:commons-collections to address 2 CVEs. Fixed in 3.1-tuxcare.1.

Record: CLSA-2026-1789362482
Updated: 2026-11-05

OSVMGASA-2016-0012 No score

Updated apache-commons-collections packages fix security vulnerability

With this update, deserialization of certain classes in the commons-collections library is no longer allowed. Applications that require those classes to be deserialized can use the system property "org.apache.commons.collections.enableUnsafeSerialization" to re-enable their deserialization.

Record: MGASA-2016-0012
Updated: 2026-11-02

OSVROOT-APP-MAVEN-CVE-2015-7501 No score

CVE-2015-7501 in commons-collections:commons-collections - Patched by Root

Root has patched CVE-2015-7501 in the commons-collections:commons-collections package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2015-7501
Updated: 2026-11-02

Affected products

Show 3 moreShow less

Affected packages

Affected packages
Package	Affected	Fixed
`commons-collections:commons-collections` Maven	before 3.2.2	3.2.2
`org.apache.commons:commons-collections4` Maven	before 4.1	4.1
`org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections` Maven	3.2.1 up to 3.2.2	3.2.2
`net.sourceforge.collections:collections-generic` Maven	4.01 to 4.01	None known
`org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic` Maven	4.01 up to 4.02	4.02
`commons-collections:commons-collections` TuxCare:Maven	3.1 up to 3.1-tuxcare.1	3.1-tuxcare.1
`libcommons-collections3-java` Debian:12	before 3.2.2-1	3.2.2-1
`libcommons-collections3-java` Debian:13	before 3.2.2-1	3.2.2-1
`libcommons-collections3-java` Debian:14	before 3.2.2-1	3.2.2-1
`libcommons-collections4-java` Debian:12	All versions, plus listed versions 4.2-14.4-14.4-2	None known

Show 290 moreShow less

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	ianxtianxt/CVE-2015-7501	2020-02-21
Nuclei	Red Hat JBoss - Insecure Deserialization

History

History
Recorded	Changed	Sources
Nov 5, 2026	affected, aliases	OSV
Nov 3, 2026	exploitation, exploits, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-7501 is a critical vulnerability (CVSS 9.8) in Redhat Data Grid, published January 14, 2016. EUVD reports exploitation since July 14, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 85.6%, the 99th percentile. Fixed in commons-collections:commons-collections 3.2.2.

References

Show 178 moreShow less

This page doesn't list everything

Left out here: 105 package rows. The JSON record has them.

Affected packages
Package	Affected	Fixed
`libcommons-collections4-java` Debian:13	All versions, plus listed versions 4.4-2	None known
`libcommons-collections4-java` Debian:14	All versions, plus listed versions 4.4-2	None known
`commons-collections:commons-collections` Maven	before 3.2.2, plus listed versions 1.02.02.0.20020914.0159532.0.20020914.0207462.0.20020914.020858 Show 7 moreShow less 2.12.1.13.03.0-dev23.13.23.2.1	3.2.2
`org.apache.commons:commons-collections4` Maven	before 4.1, plus listed versions 4.0	4.1
`org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections` Maven	3.2.1 and later, plus listed versions 3.2.1_13.2.1_23.2.1_3	None known
`net.sourceforge.collections:collections-generic` Maven	Listed versions 4.01	None known
`org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic` Maven	4.01 and later, plus listed versions 4.01_1	None known
`apache-commons-collections` Mageia:5	before 3.2.1-24.1.mga5	3.2.1-24.1.mga5
`apache-commons-collections-eap6` Red Hat:jboss_enterprise_application_platform:6::el5	before 0:3.2.1-16.redhat_5.1.ep6.el5	0:3.2.1-16.redhat_5.1.ep6.el5
`apache-commons-collections-eap6` Red Hat:jboss_enterprise_application_platform:6::el6	before 0:3.2.1-16.redhat_5.1.ep6.el6	0:3.2.1-16.redhat_5.1.ep6.el6
`apache-commons-collections-eap6` Red Hat:jboss_enterprise_application_platform:6::el7	before 0:3.2.1-16.redhat_5.1.ep6.el7	0:3.2.1-16.redhat_5.1.ep6.el7
`jakarta-commons-collections` Red Hat:enterprise_linux:6::client	before 0:3.2.1-3.5.el6_7	0:3.2.1-3.5.el6_7
`jakarta-commons-collections-javadoc` Red Hat:enterprise_linux:6::client	before 0:3.2.1-3.5.el6_7	0:3.2.1-3.5.el6_7
`jakarta-commons-collections-testframework` Red Hat:enterprise_linux:6::client	before 0:3.2.1-3.5.el6_7	0:3.2.1-3.5.el6_7
`jakarta-commons-collections-testframework-javadoc` Red Hat:enterprise_linux:6::client	before 0:3.2.1-3.5.el6_7	0:3.2.1-3.5.el6_7
`jakarta-commons-collections-tomcat5` Red Hat:enterprise_linux:6::client	before 0:3.2.1-3.5.el6_7	0:3.2.1-3.5.el6_7
`jakarta-commons-collections` Red Hat:enterprise_linux:6::computenode	before 0:3.2.1-3.5.el6_7	0:3.2.1-3.5.el6_7
`jakarta-commons-collections-javadoc` Red Hat:enterprise_linux:6::computenode	before 0:3.2.1-3.5.el6_7	0:3.2.1-3.5.el6_7
`jakarta-commons-collections-testframework` Red Hat:enterprise_linux:6::computenode	before 0:3.2.1-3.5.el6_7	0:3.2.1-3.5.el6_7
`jakarta-commons-collections-testframework-javadoc` Red Hat:enterprise_linux:6::computenode	before 0:3.2.1-3.5.el6_7	0:3.2.1-3.5.el6_7
`jakarta-commons-collections-tomcat5` Red Hat:enterprise_linux:6::computenode	before 0:3.2.1-3.5.el6_7	0:3.2.1-3.5.el6_7
`jakarta-commons-collections` Red Hat:enterprise_linux:6::server	before 0:3.2.1-3.5.el6_7	0:3.2.1-3.5.el6_7
`jakarta-commons-collections-javadoc` Red Hat:enterprise_linux:6::server	before 0:3.2.1-3.5.el6_7	0:3.2.1-3.5.el6_7
`jakarta-commons-collections-testframework` Red Hat:enterprise_linux:6::server	before 0:3.2.1-3.5.el6_7	0:3.2.1-3.5.el6_7
`jakarta-commons-collections-testframework-javadoc` Red Hat:enterprise_linux:6::server	before 0:3.2.1-3.5.el6_7	0:3.2.1-3.5.el6_7
`jakarta-commons-collections-tomcat5` Red Hat:enterprise_linux:6::server	before 0:3.2.1-3.5.el6_7	0:3.2.1-3.5.el6_7
`jakarta-commons-collections` Red Hat:enterprise_linux:6::workstation	before 0:3.2.1-3.5.el6_7	0:3.2.1-3.5.el6_7
`jakarta-commons-collections-javadoc` Red Hat:enterprise_linux:6::workstation	before 0:3.2.1-3.5.el6_7	0:3.2.1-3.5.el6_7
`jakarta-commons-collections-testframework` Red Hat:enterprise_linux:6::workstation	before 0:3.2.1-3.5.el6_7	0:3.2.1-3.5.el6_7
`jakarta-commons-collections-testframework-javadoc` Red Hat:enterprise_linux:6::workstation	before 0:3.2.1-3.5.el6_7	0:3.2.1-3.5.el6_7
`jakarta-commons-collections-tomcat5` Red Hat:enterprise_linux:6::workstation	before 0:3.2.1-3.5.el6_7	0:3.2.1-3.5.el6_7
`apache-commons-collections` Red Hat:enterprise_linux:7::client	before 0:3.2.1-22.el7_2	0:3.2.1-22.el7_2
`apache-commons-collections-javadoc` Red Hat:enterprise_linux:7::client	before 0:3.2.1-22.el7_2	0:3.2.1-22.el7_2
`apache-commons-collections-testframework` Red Hat:enterprise_linux:7::client	before 0:3.2.1-22.el7_2	0:3.2.1-22.el7_2
`apache-commons-collections-testframework-javadoc` Red Hat:enterprise_linux:7::client	before 0:3.2.1-22.el7_2	0:3.2.1-22.el7_2
`apache-commons-collections` Red Hat:enterprise_linux:7::computenode	before 0:3.2.1-22.el7_2	0:3.2.1-22.el7_2
`apache-commons-collections-javadoc` Red Hat:enterprise_linux:7::computenode	before 0:3.2.1-22.el7_2	0:3.2.1-22.el7_2
`apache-commons-collections-testframework` Red Hat:enterprise_linux:7::computenode	before 0:3.2.1-22.el7_2	0:3.2.1-22.el7_2
`apache-commons-collections-testframework-javadoc` Red Hat:enterprise_linux:7::computenode	before 0:3.2.1-22.el7_2	0:3.2.1-22.el7_2
`apache-commons-collections` Red Hat:enterprise_linux:7::server	before 0:3.2.1-22.el7_2	0:3.2.1-22.el7_2