CVE-2026-84725

HighCVSS 8.1

Published: 28/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

28th percentile - higher than 28% of all known CVEs

Summary

When EAP runs with -secmgr, openjdk-orb's JDKBridge honors attacker-supplied CDR codebase URLs during object unmarshalling on port 3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

Risk Assessment

An attacker could remotely execute malicious code in the application server context, bypassing EJB security mechanisms, potentially leading to full system compromise.

Recommendation

Restrict access to port 3528 or disable the -secmgr option if not required, and monitor incoming traffic for suspicious codebase URLs.

Other vulnerabilities in openjdk-orb

CVE-2026-15560High
When EAP runs with -secmgr, the openjdk-orb's JDKBridge honors attacker-supplied CDR codebase URLs during object unmarshalling on port 3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

Original NVD description (English source)

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS