Description

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-11T09:17:12.823Z",
  "pubdate": "2026-08-11T09:17:12.823Z",
  "executiveSummary": "A remote code execution vulnerability exists within the openjdk-orb component of EAP when running with the -secmgr configuration enabled. The vulnerability stems from the JDKBridge honoring attacker-supplied CDR codebase URLs during object unmarshalling operations over port 3528. This flaw allows an unauthenticated remote attacker to coerce the server Java Virtual Machine into dynamically loading and instantiating arbitrary classes from a remote URL. The exploitation occurs during the deserialization phase before any EJB security interceptors are executed, completely bypassing standard authentication and authorization checks. Consequently, an unauthenticated network-based attacker can achieve arbitrary remote code execution within the context of the server JVM, leading to full system compromise, data exfiltration, or complete loss of integrity and availability on affected EAP deployments.",
  "technicalDetails": "The vulnerability resides in the openjdk-orb implementation utilized by EAP, specifically within the JDKBridge component responsible for handling object unmarshalling via Common Data Representation (CDR) streams. When EAP is executed with the security manager enabled via the -secmgr argument, the underlying Object Request Broker listens on port 3528 for incoming IIOP (Internet Inter-Orb Protocol) traffic. The root cause of the vulnerability is the unsafe handling and honoring of attacker-supplied codebase URLs embedded within marshalled CDR data streams during the unmarshalling process. Because this deserialization and class loading sequence executes prior to the invocation of EJB security interceptors, authentication mechanisms fail to block the incoming malicious payload. An unauthenticated attacker sends a crafted IIOP request containing a serialized object reference with a maliciously modified codebase URL pointing to a remote server controlled by the attacker. Upon receiving the request on port 3528, the openjdk-orb JDKBridge parses the CDR stream and attempts to resolve and load the specified class from the attacker-controlled codebase URL. The server JVM fetches the malicious bytecode over the network, dynamically defines the class, and invokes its constructor or static initialization blocks. This sequence achieves arbitrary remote code execution before security boundaries or access control contexts are enforced, allowing the attacker to execute arbitrary system commands, manipulate application data, or establish persistent unauthorized access within the server environment."
}