CVE-2026-84725

CVE-2026-84725 · Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

CVSS 8.1 · Élevée · EPSS 0,3%

Publication

2026-10-28T17:30:13.626Z

Mise à jour

2026-10-28T17:30:13.626Z

Vérifiez votre serveur →