CVE-2026-84725

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

Score

CVSS 3.1 8.1 High

Status

Awaiting Analysis - secalert@redhat.com

Published

2026-10-28

Last modified

2026-10-28

Weaknesses

CWE-829

Affected products

• Jboss Enterprise Application Platform (Redhat)

References

• https://access.redhat.com/security/cve/CVE-2026-84725
• https://bugzilla.redhat.com/show_bug.cgi?id=2527228