CVE-2026-84725: Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap

Published Oct 28, 2026

Updated

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

Affected Software

1 affected component

Red Hat JBoss Enterprise Application Platform

Event History

Oct 28, 2026

CVE Published

via MITRE·05:30 PM

Data Sourced

via MITRE·05:30 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue affects Red Hat JBoss Enterprise Application Platform deployments running with the -secmgr option. The exposed IIOP service is described as listening on port 3528.

Does an attacker need credentials or a user action to exploit it?

No. Exploitation is described as unauthenticated and requires no user interaction, although the attack complexity is rated high.

What can the attacker do if exploitation succeeds?

An attacker can cause the server JVM to load and instantiate arbitrary classes from an attacker-supplied remote URL during object unmarshalling. This occurs before EJB security interceptors run.

CVE-2026-84725: Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

Does an attacker need credentials or a user action to exploit it?

What can the attacker do if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

Does an attacker need credentials or a user action to exploit it?

What can the attacker do if exploitation succeeds?