CVE-2026-15560
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
When EAP runs with -secmgr, the openjdk-orb's JDKBridge honors attacker-supplied CDR codebase URLs during object unmarshalling on port 3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.
Risk Assessment
Risk of remote code execution in the server JVM before security checks, potentially leading to full server compromise.
Recommendation
Disable -secmgr if not required, or apply vendor patches to restrict codebase URLs during unmarshalling.
Original NVD description (English source)
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.