CVE-2026-84725

CVE-2026-84725 · Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

CVSS 8.1 · Alta · EPSS 0,3%

Publicación

2026-10-28T17:30:13.626Z

Actualización

2026-10-28T17:30:13.626Z

Comprueba tu servidor →