Red Hat JBoss EAP 8.1.8 Addresses 36 Vulnerabilities
Tech GuruQuick Answer
Red Hat JBoss EAP 8.1.8 replaces 8.1.7 and addresses the 36 CVEs below for the listed RHEL 8, 9 and 10 installations. Apply the supported EAP package set for the host platform, not a hand-selected replacement JAR.
Confirm Scope And Apply The Supported Fix
What to do now: Match EAP installations to the RHEL-specific advisory, apply prerequisite errata, and back up applications, configuration, databases and database settings before the supported update.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Red Hat JBoss Enterprise Application Platform 8.1 on RHEL 8, 9, and 10 |
|---|---|
| Advisory | RHSA-2026:70229 / RHSA-2026:70228 / RHSA-2026:70230 |
| CVEs | CVE-2026-10832, CVE-2026-14180, CVE-2026-15554, CVE-2026-15555, CVE-2026-15560, CVE-2026-15561, CVE-2026-15562, CVE-2026-15563, CVE-2026-15565, CVE-2026-15567, CVE-2026-3505, CVE-2026-44417, CVE-2026-46581, CVE-2026-49362, CVE-2026-49363, CVE-2026-49364, CVE-2026-49875, CVE-2026-50632, CVE-2026-54512, CVE-2026-54513, CVE-2026-54515, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-56746, CVE-2026-5680, CVE-2026-57967, CVE-2026-59649, CVE-2026-59889, CVE-2026-59899, CVE-2026-62243, CVE-2026-68494, CVE-2026-69152, CVE-2026-73508, CVE-2026-85511, CVE-2026-86404 |
| Authoritative release date | RHSA-2026:70229: 2026-09-22T13:03:54+00:00 (CSAF initial release) RHSA-2026:70228: 2026-09-22T13:04:08+00:00 (CSAF initial release) RHSA-2026:70230: 2026-09-22T13:04:13+00:00 (CSAF initial release) |
| Authority revision date | RHSA-2026:70229: 2026-09-22T13:03:54+00:00 (CSAF revision history) RHSA-2026:70228: 2026-09-22T13:04:08+00:00 (CSAF revision history) RHSA-2026:70230: 2026-09-22T13:04:13+00:00 (CSAF revision history). CSAF generation timestamps are not advisory revision dates. |
| Affected versions | The exact entitled Red Hat JBoss Enterprise Application Platform 8.1 on RHEL 8, 9, and 10 builds before the branch-specific package, image, or digest listed by Red Hat. |
| Fixed version | JBoss EAP 8.1.8 complete supported update:RHEL 8: RHSA-2026:70228. RHEL 9: RHSA-2026:70229. RHEL 10: RHSA-2026:70230. Match all applicable RPMs to the advisory; the EAP version is not an instruction to replace just one bundled component. |
| CVSS base score | 4.2 / 5.3 / 5.9 / 6.5 / 7.4 / 7.5 / 8.0 / 8.1 / 8.2 / 8.8 (CVSS v3.1) |
| CVSS severity | Medium to High |
| Exploitation status | The three EAP advisories does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
The fixes span Jackson, Netty, Undertow, Artemis, CXF, Elytron and other EAP components. They include parsing/resource exhaustion, authentication and deserialization issues with different feature prerequisites. Assess enabled listeners and application use, but do not treat disabling one feature as remediation for the whole platform update.
What To Validate Now
- Inventory. Locate Red Hat JBoss Enterprise Application Platform 8.1 on RHEL 8, 9, and 10 deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: The exact entitled Red Hat JBoss Enterprise Application Platform 8.1 on RHEL 8, 9, and 10 builds before the branch-specific package, image, or digest listed by Red Hat. Do not infer applicability from product family or severity alone.
- Remediate. After the required backups and prerequisite errata, apply the complete EAP 8.1.8 update for the installed platform. Coordinate clustered/domain deployments and preserve a supported recovery path.
- Validate. Verify the EAP runtime and complete updated package set, then test application deployment, authentication, HTTP/WebSocket traffic and any configured messaging, IIOP or cluster workflows. Preserve rollback and restore evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
