CVE-2026-15555 [HIGH] – A flaw was found in JBoss marshalling. The Infinispan session replication path deserialize

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.