CVE-2016-3690

CVE-2016-3690 affects JBoss EAP 4.x/5.x where the PooledInvokerServlet deserializes crafted payloads, enabling remote code execution. The vulnerability stems from insecure deserialization in the servlet, allowing an attacker to run arbitrary code on the JVM. Red Hat guidance notes that the Pooled...