Is CVE-2015-7450 actively exploited?

Yes. CVE-2015-7450 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2015-7450 be exploited remotely?

The attack vector of CVE-2015-7450 has not been classified yet.

What is the CVSS score of CVE-2015-7450?

CVE-2015-7450 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2015-7450

HIGHCISA KEVIN THE WILD

CVE-2015-7450

Published: January 10, 2022

EPSS:93.49%probability of exploitation in 30 daysPercentile:99.8th

Official Description

Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands

NVD Source

CISA KEV Advisory

IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.

Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands

Added to KEV: 2022-01-10Federal patch deadline: 2022-07-10

Required Action (CISA)

Apply updates per vendor instructions.

Risk Analysis

This vulnerability affects various IBM products, allowing remote attackers to execute arbitrary commands through serialized-object interfaces. With an EPSS score of 0.93487 and its inclusion in CISA's KEV, this flaw is highly likely to be exploited and poses a significant risk to affected systems. The ability to execute arbitrary commands remotely is a critical security concern.

This vulnerability is actively exploited in the wild. The nature of serialized-object interface vulnerabilities often allows for remote exploitation with low complexity.

Recommended Action

Administrators should apply all available security patches and upgrades for affected IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products. Reviewing and hardening configurations related to object serialization can also help mitigate this risk.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2015-7450 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2015-7450 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.