CVE-2026-84725

CVE-2026-84725 · Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap

This page contains facts from public vulnerability sources. Check the original advisory before updating.

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

CVSS 8.1 · High · EPSS 0.3%

Published

2026-10-28T17:30:13.626Z

Updated

2026-10-28T17:30:13.626Z

Check your server →