CVE-2026-33439
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
OpenAM prior to 16.0.6 is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter, bypassing the WhitelistObjectInputStream mitigation applied to jato.pageSession after CVE-2021-35464.
Risk Assessment
An unauthenticated attacker can remotely execute arbitrary commands on the OpenAM server, potentially leading to full compromise of the access management system and access to all protected applications.
Recommendation
Immediately update OpenAM to version 16.0.6 or later.
Original NVD description (English source)
Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains <jato:form> tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6.