High severity · published Oct 28, 2026
CVE-2026-84725
Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap
New
8.1
CVSS
–
EPSS
No
On KEV
Description
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat JBoss Enterprise Application Platform 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform 8 · Red Hat
All versions, or not specified · source: vendor
Affected product
RH
Red Hat JBoss Enterprise Application Platform 7
Red Hat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-84725
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-84725
vdb-entry
https://access.redhat.com/security/cve/CVE-2026-84725
issue-tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2527228
More from Red Hat JBoss Enterprise Application Platform 7
9.8
CVE-2026-10579
Picketlink-federation: auth bypass in picketlink saml unsolicited-response
9.8
CVE-2026-49875
Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
9.8
CVE-2026-27727
mchange-commons-java: Remote Code Execution via JNDI Reference Resolution
9.6
CVE-2025-12543
Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf
9.1
CVE-2026-28369
Undertow: undertow: request smuggling via malformed http request headers