VulnSocial

CVE-2007-1036Exploit(jboss / jboss_application_server)

HIGHCVSS 7.5 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for jboss jboss_application_server systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

The default configuration of JBoss does not restrict access to the (1) console and (2) web management interfaces, which allows remote attackers to bypass authentication and gain administrative access via direct requests.

jboss CVEsBack to dashboard
7.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-264

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • jboss_application_server

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC and exploit tooling are both present
  • 1 mentions across 1 observed day

What's happening

  • Active exploitation reported across 1 signal
  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
jboss
Products
jboss_application_server

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-02-03: 1PoC Mentioned / Linked · 2026-02-03: 1Exploit Tool / Code · 2026-02-03: 1Active Exploitation · 2026-02-03: 1Technical Details · 2026-02-03: 102-03
Signal classification1 categories
Exploit
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • André Baptista@0xacb
    Exploit

    404 page to RCE. A report by @spaceraccoonsec He chained two old CVEs to achieve RCE: - Found a 404 page mentioning an obscure CMS, discovered /josso/signin login - Triggered CVE-2007-0450 (directory traversal in mod_proxy) using a %5C../ to bypass the internal proxy - Reached an unprotected JBoss web console on localhost (CVE-2007-1036) - Exploited Java deserialization with jexboss tool for full RCE Full report 👇 https://hackerone.com/reports/502758

    Post summary

    The tweet reports an active exploitation chain using two legacy CVEs, describes the technical steps and a specific exploit tool (jexboss), and links to a full HackerOne report detailing the PoC.

    1288173750836.1K
    18.7K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appjbossjboss_application_server---

Explore more

Back to dashboardjboss CVEsjboss_application_server vulnerabilities