CVE-2015-6420Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Device…
Updated under an hour ago ()
Does this affect you?
It affects apache commons_collections. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
- CVSS
- 9.8 CRITICAL (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-502
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Modified
- Record last updated
- Oct 7, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
apache commons_collections apache:commons_collections | from 3.0 before 3.2.2; 4.0 | NVD |
References
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserializationthird-party-advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlthird-party-advisory
- http://www.securityfocus.com/bid/78872third-party-advisory, vdb-entry
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917third-party-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722third-party-advisory
- https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21%40%3Ccommits.samza.apache.org%3Evendor-advisory
- https://www.kb.cert.org/vuls/id/581311third-party-advisory
- https://www.tenable.com/security/research/tra-2017-14third-party-advisory
- https://www.tenable.com/security/research/tra-2017-23third-party-advisory
- https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/exploit, third-party-advisory
- https://news.apache.org/foundation/entry/apache_commons_statement_to_widespreadvendor-advisory
- https://www.kb.cert.org/vuls/id/576313third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.