Live › vulnerability › CVE-2026-84725
Go to dashboardWhen JBoss EAP runs with the -secmgr flag, the OpenJDK ORB's JDKBridge accepts attacker-supplied codebase URLs during CORBA object unmarshalling on port 3528. An unauthenticated attacker can make the server JVM load and instantiate arbitrary classes from a remote URL before EJB security checks run.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Only JBoss EAP deployments that run with the Java security manager enabled through and expose the IIOP/ORB listener on port 3528 are described as exposed. Installations without , or with port 3528 limited to trusted networks, are likely lower risk, but the sources do not say more.
-secmgr-secmgrNo product ranges from the sources yet.
-secmgr in its startup arguments or standalone.conf3528 (IIOP) is reachable from untrusted networks-secmgr from the startup configuration if the security manager is not required3528 at the network edge if IIOP is not neededEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.
This page as .md · .json · in your agent: get_signal("CVE-2026-84725")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.