{"id":"CVE-2015-6420","aliases":["CLSA-2026-1777509604","CLSA-2026-1778114665","CLSA-2026-1789362482","EUVD-2020-0464","GHSA-6hgm-866r-3cjv","ROOT-APP-MAVEN-CVE-2015-6420"],"status":"published","title":"Insecure Deserialization in Apache Commons Collection","description":"Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.24233,"percentile":0.9787,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-502"],"published":"2015-12-15T02:00:00Z","modified":"2026-11-05T13:28:25Z","exploits":[{"source":"pocgithub","id":"Leeziao/CVE-2015-6420","title":"Leeziao/CVE-2015-6420","date":"2025-04-16","url":"https://github.com/Leeziao/CVE-2015-6420"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.commons:commons-collections4","fixed_in":["4.1"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"commons-collections:commons-collections","fixed_in":["3.2.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"commons-collections:commons-collections","fixed_in":["3.2.1-tuxcare.1","3.2-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"commons-collections:commons-collections","fixed_in":["2.0-aikido.2","3.1-aikido.3","2.1-aikido.2","3.2-aikido.2","3.2.1-aikido.3","3.2.1-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.commons-collections:commons-collections","fixed_in":["2.1-root.io.1","2.0-root.io.1","3.2-root.io.1","3.1-root.io.2","3.2.1-root.io.2","2.0-root.io.2","3.1-root.io.3","2.1-root.io.2","3.2-root.io.2","3.2.1-root.io.3","3.2.1-root.io.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.commons:commons-collections4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"commons-collections:commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"net.sourceforge.collections:collections-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.0.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.01"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.2.1"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-collections:commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.1"},{"fixed":"3.2.1-tuxcare.1"}]}],"versions":["3.2.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-collections:commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2"},{"fixed":"3.2-tuxcare.1"}]}],"versions":["3.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-collections:commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1"},{"fixed":"3.1-tuxcare.1"}]}],"versions":["3.1"],"bundled":2},{"source":"osv","ecosystem":"Maven","package":"org.apache.commons:commons-collections4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1"}]}],"versions":["4.0"]},{"source":"osv","ecosystem":"Maven","package":"commons-collections:commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2"}]}],"versions":["1.0","2.0","2.0.20020914.015953","2.0.20020914.020746","2.0.20020914.020858","2.1","2.1.1","3.0","3.0-dev2","3.1","3.2","3.2.1"]},{"source":"osv","ecosystem":"Maven","package":"net.sourceforge.collections:collections-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.0.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.01"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.2.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"commons-collections:commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-aikido.2"},{"fixed":"3.1-aikido.3"},{"fixed":"2.1-aikido.2"},{"fixed":"3.2-aikido.2"},{"fixed":"3.2.1-aikido.3"},{"fixed":"3.2.1-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.commons-collections:commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-root.io.1"},{"fixed":"2.0-root.io.1"},{"fixed":"3.2-root.io.1"},{"fixed":"3.1-root.io.2"},{"fixed":"3.2.1-root.io.2"},{"fixed":"2.0-root.io.2"},{"fixed":"3.1-root.io.3"},{"fixed":"2.1-root.io.2"},{"fixed":"3.2-root.io.2"},{"fixed":"3.2.1-root.io.3"},{"fixed":"3.2.1-root.io.4"}]}]}],"products":[{"vendor":"apache","product":"commons_collections"}],"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization","tags":["vendor-advisory","x_refsource_CISCO","x_transferred","Third Party Advisory","web"]},{"url":"http://www.securityfocus.com/bid/78872","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","web"]},{"url":"https://www.tenable.com/security/research/tra-2017-23","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"https://www.kb.cert.org/vuls/id/581311","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","web"]},{"url":"https://www.tenable.com/security/research/tra-2017-14","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21%40%3Ccommits.samza.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/576313","tags":["Third Party Advisory"]},{"url":"https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/","tags":["Exploit","Third Party Advisory"]},{"url":"https://news.apache.org/foundation/entry/apache_commons_statement_to_widespread","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-6420","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21@%3Ccommits.samza.apache.org%3E","tags":["web"]},{"url":"https://arxiv.org/pdf/2306.05534","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6hgm-866r-3cjv"},{"url":"https://github.com/apache/commons-collections","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2015-6420","description":"Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.","status":"published","published":"2015-12-15T02:00:00Z","modified":"2026-10-07T17:55:52.257Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:35:42.680858Z"}],"euvd":[{"id":"EUVD-2020-0464","description":"Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.","status":"published","published":"2015-12-15T02:00:00Z","modified":"2026-10-07T17:55:52Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:27:34.815018Z"}],"ghsa":[{"id":"GHSA-6hgm-866r-3cjv","title":"Insecure Deserialization in Apache Commons Collection","description":"Serialized-object interfaces in Java applications using the Apache Commons Collections (ACC) library may allow remote attackers to execute arbitrary commands via a crafted serialized Java object.","status":"published","published":"2020-06-15T20:36:20Z","modified":"2023-06-12T21:58:57Z","cwes":["CWE-502"],"updated_at":"2026-11-02T14:36:53.103029Z"}],"nvd":[{"id":"CVE-2015-6420","description":"Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.","status":"published","published":"2015-12-15T05:59:07.823Z","modified":"2026-10-07T18:17:07.41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:03:14.501367Z"}],"osv":[{"id":"CLSA-2026-1777509604","title":"TuxCare security update for commons-collections:commons-collections (1 CVE)","description":"TuxCare rebuilt commons-collections:commons-collections to address 1 CVE. Fixed in 3.2.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-30T19:45:02.835251265Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1778114665","title":"TuxCare security update for commons-collections:commons-collections (1 CVE)","description":"TuxCare rebuilt commons-collections:commons-collections to address 1 CVE. Fixed in 3.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-30T19:45:21.271381545Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1789362482","title":"TuxCare security update for commons-collections:commons-collections (2 CVEs)","description":"TuxCare rebuilt commons-collections:commons-collections to address 2 CVEs. Fixed in 3.1-tuxcare.1.","status":"published","published":"2026-09-14T05:08:02Z","modified":"2026-11-05T13:28:25.556920882Z","updated_at":"2026-11-05T16:37:45.64821Z"},{"id":"GHSA-6hgm-866r-3cjv","title":"Insecure Deserialization in Apache Commons Collection","description":"Serialized-object interfaces in Java applications using the Apache Commons Collections (ACC) library may allow remote attackers to execute arbitrary commands via a crafted serialized Java object.","status":"published","published":"2020-06-15T20:36:20Z","modified":"2024-11-28T05:40:45.267146Z","cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"ROOT-APP-MAVEN-CVE-2015-6420","title":"CVE-2015-6420 in commons-collections:commons-collections - Patched by Root","description":"Root has patched CVE-2015-6420 in the commons-collections:commons-collections package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-08-04T14:36:13Z","modified":"2026-08-04T19:30:25.968411254Z","updated_at":"2026-11-02T15:53:26.76659Z"}]}}