VulnSocial

CVE-2025-23368Disclosure(redhat / data_grid)

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch redhat data_grid systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.

redhat CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-307

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • data_grid
  • jboss_enterprise_application_platform
  • wildfly_core

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-02-14); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
redhat
Products
data_gridjboss_enterprise_application_platformwildfly_core

3 versions affected across 3 products

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-02-14: 2Mentions · 2026-05-29: 1Patch / Workaround · 2026-02-14: 1Technical Details · 2026-02-14: 1Technical Details · 2026-05-29: 102-1405-29
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-02-142
Disclosure1Patch1
2026-05-291
Disclosure1
Full discourse3 posts
  • DFIR Lab@DFIR_Lab
    Disclosure

    🚨 HIGH Severity: CVE-2025-23368 (CVSS 8.1) Wildfly Elytron vulnerable to brute force attacks via CLI due to insufficient authentication attempt limits. Affected: Wildfly Elytron integration CWE-307: Improper Restriction of Excessive Authentication Attempts https://t.co/eSaTScWczI

    Post summary

    The tweet discloses a high‑severity CVE-2025-23368 affecting Wildfly Elytron CLI, highlighting a brute‑force vulnerability tied to CWE‑307 and a CVSS score of 8.1, but it does not provide a PoC, exploit code, patch, or evidence of active exploitation.

    0000031
    31 followersView on X
  • CyberLen AI@views2day
    Patch

    🚨 Security Digest: Feb 13, 2026 2 critical vulnerabilities dropped: • lakeFS - path traversal flaw (CVE-2026-26187) • WildFly - brute force risk (CVE-2025-23368) If you're running either, patch now. Full details: http://cyberlensai.com/news/security-digest-2026-02-13

    Post summary

    The digest reports two critical CVEs—CVE-2026-26187 for lakeFS and CVE-2025-23368 for WildFly—and urges users to apply available patches immediately.

    0000048
    915 followersView on X
  • cvereports@_cvereports
    Disclosure

    CVE-2025-23368: The Infinite Keyring: Brute-Forcing WildFly Elytron (CVE-2025-23368) In the world of enterprise Java, WildFly (formerly JBoss) is a titan. But even titans have Achilles' heels. CVE-2025-23368 reveals a glaring oversight in the Elytron ... https://cvereports.com/reports/CVE-2025-23368

    Post summary

    The post announces CVE-2025-23368 affecting WildFly Elytron, noting a general oversight but providing no technical details, patches, or exploitation evidence.

    0000033
    26 followersView on X
CPE platform detail4 entries

4 of 4 entries

PartVendorProductVersionTarget SWTarget HW
Appredhatdata_grid8.0--
Appredhatjboss_enterprise_application_platform7.0.0--
Appredhatjboss_enterprise_application_platform8.0.0--
Appredhatwildfly_core---

Explore more

Back to dashboardredhat CVEsdata_grid vulnerabilities