Openjdk-orb: unauthed class loading via iiop in eap

Summary

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

Timeline

1. Aug 11, 2026, 8:49 AM UTCCVE published
2. Aug 12, 2026, 2:55 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 20, 2026, 2:21 PM UTCRecord last updated

Affected versions

• openjdk-orb

  Version range not reported

• eap7-activemq-artemis

  Version range not reported

• eap7-glassfish-jsf

  Version range not reported

• eap7-ironjacamar

  Version range not reported

• eap7-jackson-annotations

  Version range not reported

• eap7-jackson-core

  Version range not reported

• eap7-jackson-databind

  Version range not reported

• eap7-jackson-jaxrs-providers

  Version range not reported

• eap7-jackson-modules-base

  Version range not reported

• eap7-jackson-modules-java8

  Version range not reported

• eap7-jboss-remoting

  Version range not reported

• eap7-jboss-server-migration

  Version range not reported

• eap7-netty

  Version range not reported

• eap7-netty-transport-native-epoll

  Version range not reported

• eap7-picketlink-bindings

  Version range not reported

• eap7-picketlink-federation

  Version range not reported

• eap7-undertow

  Version range not reported

• eap7-wildfly

  Version range not reported

• eap7-activemq-artemis

  Version range not reported

• eap7-glassfish-jsf

  Version range not reported

• eap7-ironjacamar

  Version range not reported

• eap7-jackson-annotations

  Version range not reported

• eap7-jackson-core

  Version range not reported

• eap7-jackson-databind

  Version range not reported

• eap7-jackson-jaxrs-providers

  Version range not reported

• eap7-jackson-modules-base

  Version range not reported

• eap7-jackson-modules-java8

  Version range not reported

• eap7-jboss-remoting

  Version range not reported

• eap7-jboss-server-migration

  Version range not reported

• eap7-netty

  Version range not reported

• eap7-netty-transport-native-epoll

  Version range not reported

• eap7-picketlink-bindings

  Version range not reported

• eap7-picketlink-federation

  Version range not reported

• eap7-undertow

  Version range not reported

• eap7-wildfly

  Version range not reported

• eap7-activemq-artemis

  Version range not reported

• eap7-glassfish-jsf

  Version range not reported

• eap7-ironjacamar

  Version range not reported

• eap7-jackson-annotations

  Version range not reported

• eap7-jackson-core

  Version range not reported

• eap7-jackson-databind

  Version range not reported

• eap7-jackson-jaxrs-providers

  Version range not reported

• eap7-jackson-modules-base

  Version range not reported

• eap7-jackson-modules-java8

  Version range not reported

• eap7-jboss-remoting

  Version range not reported

• eap7-jboss-server-migration

  Version range not reported

• eap7-netty

  Version range not reported

• eap7-netty-transport-native-epoll

  Version range not reported

• eap7-picketlink-bindings

  Version range not reported

• eap7-picketlink-federation

  Version range not reported

• eap7-undertow

  Version range not reported

• eap7-wildfly

  Version range not reported

• org.jboss.eap/wildfly-iiop-openjdk

  Version range not reported

• eap8-activemq-artemis

  Version range not reported

• eap8-apache-cxf

  Version range not reported

• eap8-artemis-wildfly-integration

  Version range not reported

• eap8-bouncycastle

  Version range not reported

• eap8-cryptacular

  Version range not reported

• eap8-eap-product-conf-parent

  Version range not reported

• eap8-hibernate

  Version range not reported

• eap8-httpcomponents-asyncclient

  Version range not reported

• eap8-ironjacamar

  Version range not reported

• eap8-jackson-annotations

  Version range not reported

• eap8-jackson-core

  Version range not reported

• eap8-jackson-databind

  Version range not reported

• eap8-jackson-dataformats-text

  Version range not reported

• eap8-jackson-jaxrs-providers

  Version range not reported

• eap8-jackson-modules-base

  Version range not reported

• eap8-jackson-modules-java8

  Version range not reported

• eap8-jakarta-xml-bind-api

  Version range not reported

• eap8-jaxb

  Version range not reported

• eap8-jaxbintros

  Version range not reported

• eap8-jboss-logging

  Version range not reported

• eap8-jboss-remoting

  Version range not reported

• eap8-jbossws-api

  Version range not reported

• eap8-jbossws-common-tools

  Version range not reported

• eap8-jbossws-cxf

  Version range not reported

• eap8-jbossws-jaxws-undertow-httpspi

  Version range not reported

• eap8-jbossws-spi

  Version range not reported

• eap8-jsf-impl

  Version range not reported

• eap8-log4j

  Version range not reported

• eap8-neethi

  Version range not reported

• eap8-netty

  Version range not reported

• eap8-netty-transport-native-epoll

  Version range not reported

• eap8-nimbus-jose-jwt

  Version range not reported

• eap8-parsson

  Version range not reported

• eap8-saaj-impl

  Version range not reported

• eap8-slf4j

  Version range not reported

• eap8-undertow

  Version range not reported

• eap8-wildfly

  Version range not reported

• eap8-wildfly-elytron

  Version range not reported

• eap8-wildfly-javadocs

  Version range not reported

• eap8-ws-commons-XmlSchema

  Version range not reported

• eap8-xml-security

  Version range not reported

• eap8-activemq-artemis

  Version range not reported

• eap8-apache-cxf

  Version range not reported

• eap8-artemis-wildfly-integration

  Version range not reported

• eap8-bouncycastle

  Version range not reported

• eap8-cryptacular

  Version range not reported

• eap8-eap-product-conf-parent

  Version range not reported

• eap8-hibernate

  Version range not reported

• eap8-httpcomponents-asyncclient

  Version range not reported

• eap8-ironjacamar

  Version range not reported

• eap8-jackson-annotations

  Version range not reported

• eap8-jackson-core

  Version range not reported

• eap8-jackson-databind

  Version range not reported

• eap8-jackson-dataformats-text

  Version range not reported

• eap8-jackson-jaxrs-providers

  Version range not reported

• eap8-jackson-modules-base

  Version range not reported

• eap8-jackson-modules-java8

  Version range not reported

• eap8-jakarta-xml-bind-api

  Version range not reported

• eap8-jaxb

  Version range not reported

• eap8-jaxbintros

  Version range not reported

• eap8-jboss-logging

  Version range not reported

• eap8-jboss-remoting

  Version range not reported

• eap8-jbossws-api

  Version range not reported

• eap8-jbossws-common-tools

  Version range not reported

• eap8-jbossws-cxf

  Version range not reported

• eap8-jbossws-jaxws-undertow-httpspi

  Version range not reported

• eap8-jbossws-spi

  Version range not reported

• eap8-jsf-impl

  Version range not reported

• eap8-log4j

  Version range not reported

• eap8-neethi

  Version range not reported

• eap8-netty

  Version range not reported

• eap8-netty-transport-native-epoll

  Version range not reported

• eap8-nimbus-jose-jwt

  Version range not reported

• eap8-parsson

  Version range not reported

• eap8-saaj-impl

  Version range not reported

• eap8-slf4j

  Version range not reported

• eap8-undertow

  Version range not reported

• eap8-wildfly

  Version range not reported

• eap8-wildfly-elytron

  Version range not reported

• eap8-wildfly-javadocs

  Version range not reported

• eap8-ws-commons-XmlSchema

  Version range not reported

• eap8-xml-security

  Version range not reported

• eap8-activemq-artemis

  Version range not reported

• eap8-apache-cxf

  Version range not reported

• eap8-artemis-wildfly-integration

  Version range not reported

• eap8-bouncycastle

  Version range not reported

• eap8-cryptacular

  Version range not reported

• eap8-eap-product-conf-parent

  Version range not reported

• eap8-hibernate

  Version range not reported

• eap8-httpcomponents-asyncclient

  Version range not reported

• eap8-ironjacamar

  Version range not reported

• eap8-jackson-annotations

  Version range not reported

• eap8-jackson-core

  Version range not reported

• eap8-jackson-databind

  Version range not reported

• eap8-jackson-dataformats-text

  Version range not reported

• eap8-jackson-jaxrs-providers

  Version range not reported

• eap8-jackson-modules-base

  Version range not reported

• eap8-jackson-modules-java8

  Version range not reported

• eap8-jakarta-xml-bind-api

  Version range not reported

• eap8-jaxb

  Version range not reported

• eap8-jaxbintros

  Version range not reported

• eap8-jboss-logging

  Version range not reported

• eap8-jboss-remoting

  Version range not reported

• eap8-jbossws-api

  Version range not reported

• eap8-jbossws-common-tools

  Version range not reported

• eap8-jbossws-cxf

  Version range not reported

• eap8-jbossws-jaxws-undertow-httpspi

  Version range not reported

• eap8-jbossws-spi

  Version range not reported

• eap8-jsf-impl

  Version range not reported

• eap8-log4j

  Version range not reported

• eap8-neethi

  Version range not reported

• eap8-netty

  Version range not reported

• eap8-netty-transport-native-epoll

  Version range not reported

• eap8-nimbus-jose-jwt

  Version range not reported

• eap8-parsson

  Version range not reported

• eap8-saaj-impl

  Version range not reported

• eap8-slf4j

  Version range not reported

• eap8-undertow

  Version range not reported

• eap8-wildfly

  Version range not reported

• eap8-wildfly-elytron

  Version range not reported

• eap8-wildfly-javadocs

  Version range not reported

• eap8-ws-commons-XmlSchema

  Version range not reported

• eap8-xml-security

  Version range not reported

• openjdk-orb

  Version range not reported

References 10