CVE-2018-14667: Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 28 Sep 2023, 1,787 days after the CVE record was published.
- How likely is exploitation in the next 30 days?
- 74.2%
EPSS score, percentile 99.5 of all scored records
- How severe?
- 9.8 Critical
CVSS v3.0 base score, given by the CNA
- What should I do?
Required action (CISA), due 19 Oct 2023: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Which versions are affected?
Affected: affected 3.X through 3.3.4
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
What to do
Required action, set by CISA
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date for this action: 19 October 2023.
Advisories and patches
Linked from CISA's catalog entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667
- https://nvd.nist.gov/vuln/detail/CVE-2018-14667
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | affected 3.X through 3.3.4 |
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
About this vulnerability
Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
Summary: CISA's KEV catalog, as of 28 Oct 2026.
- CISA added CVE-2018-14667 to its Known Exploited Vulnerabilities (KEV) catalog on 28 Sep 2023.
- CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
- The due date CISA sets for the required action is 19 Oct 2023.
- The CVE record was published on 6 Nov 2018, 1,787 days before it was added to KEV.
- The CVE record carries a CVSS v3.0 base score of 9.8 (Critical), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 74.2% (percentile 99.5), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable yes, technical impact total.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.
Description
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Weakness
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| 6 Nov 2018 | CVE record published |
| 28 Sep 2023 | Added to CISA KEV |
| 19 Oct 2023 | CISA due date for the required action |
| 21 Oct 2025 | CVE record last updated |
References
More exploited Red Hat vulnerabilities
- CVE-2015-3246: Red Hat Libuser Race Condition Vulnerability
- CVE-2015-5287: Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
- CVE-2021-3560: Red Hat Polkit Incorrect Authorization Vulnerability
- CVE-2021-4034: Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
- CVE-2010-0738: Red Hat JBoss Authentication Bypass Vulnerability
- CVE-2010-1428: Red Hat JBoss Information Disclosure Vulnerability