{"id":"CVE-2026-84725","kind":"vulnerability","aliases":["CVE-2026-84725"],"related":[],"title":"JBoss EAP: unauthenticated remote class loading via CDR codebase URLs","description":"when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.","summary":"When JBoss EAP runs with the -secmgr flag, the OpenJDK ORB's JDKBridge accepts attacker-supplied codebase URLs during CORBA object unmarshalling on port 3528. An unauthenticated attacker can make the server JVM load and instantiate arbitrary classes from a remote URL before EJB security checks run.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ejb","java","jboss-eap","runtime","self-hosted"],"not_affected_if":["default-config","no-secmgr"],"how_to_check":"- Check whether the server starts with `-secmgr` in its startup arguments or `standalone.conf`\n- Check whether port `3528` (IIOP) is reachable from untrusted networks\n- Check the installed EAP version against the fixed release listed in the advisory","fix":"- Apply the vendor patch for the affected JBoss EAP release (exact versions unknown from the sources)\n- Remove `-secmgr` from the startup configuration if the security manager is not required\n- Block port `3528` at the network edge if IIOP is not needed","status":"open","published_at":"2026-10-28T18:17:20+00:00","first_seen_at":"2026-10-28T18:34:34+00:00","triaged_at":"2026-10-28T18:34:51+00:00","updated_at":"2026-10-28T18:34:51+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-28T18:34:51Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the vendor patch for the affected JBoss EAP release (exact versions unknown from the sources)\n- Remove `-secmgr` from the startup configuration if the security manager is not required\n- Block port `3528` at the network edge if IIOP is not needed","reach":"network","title":"JBoss EAP: unauthenticated remote class loading via CDR codebase URLs","impact":"high","summary":"When JBoss EAP runs with the -secmgr flag, the OpenJDK ORB's JDKBridge accepts attacker-supplied codebase URLs during CORBA object unmarshalling on port 3528. An unauthenticated attacker can make the server JVM load and instantiate arbitrary classes from a remote URL before EJB security checks run.","category":"runtime","nicknames":[],"who_cares":["jboss-eap","java","self-hosted","ejb"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary code inside the server JVM without credentials","analyst_note":"Confirm affected and fixed EAP versions and the exact -secmgr condition at https://nvd.nist.gov/vuln/detail/CVE-2026-84725 and the vendor advisory.","how_to_check":"- Check whether the server starts with `-secmgr` in its startup arguments or `standalone.conf`\n- Check whether port `3528` (IIOP) is reachable from untrusted networks\n- Check the installed EAP version against the fixed release listed in the advisory","needs_analyst":true,"not_affected_if":["default-config","no-secmgr"],"who_is_affected":"Only JBoss EAP deployments that run with the Java security manager enabled through `-secmgr` and expose the IIOP/ORB listener on port 3528 are described as exposed. Installations without `-secmgr`, or with port 3528 limited to trusted networks, are likely lower risk, but the sources do not say more.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000682,"input_tokens":3337,"output_tokens":697,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-84725':13A,16A '3528':51B,96C 'accept':39B 'allow':97C 'arbitrari':63B,105C 'attack':41B,54B,87C,100C 'attacker-suppli':40B,86C 'cdr':8A,89C 'check':72B 'class':5A,64B,106C 'codebas':9A,43B,90C 'corba':46B 'cve':11A,14A 'eap':2A,21B,28B,75C 'ejb':17B,70B,116C 'flag':33B 'honour':85C 'host':25B 'instanti':62B,104C 'interceptor':118C 'java':18B 'jboss':1A,20B,27B 'jboss-eap':19B 'jdkbridg':38B,84C 'jvm':59B,114C 'load':6A,60B,102C 'make':56B 'object':47B,93C 'openjdk':35B,81C 'openjdk-orb':80C 'orb':36B,82C 'port':50B 'remot':4A,67B,109C 'run':29B,73B,76C,119C 'runtim':22B 'secmgr':32B,78C 'secur':71B,117C 'self':24B 'self-host':23B 'server':58B,113C 'suppli':42B,88C 'unauthent':3A,53B,99C 'unmarshal':48B,94C 'url':10A,44B,68B,91C,110C 'via':7A","nicknames":[],"mitigations":[],"who_affected":"Only JBoss EAP deployments that run with the Java security manager enabled through `-secmgr` and expose the IIOP/ORB listener on port 3528 are described as exposed. Installations without `-secmgr`, or with port 3528 limited to trusted networks, are likely lower risk, but the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84725","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84725","severity":null,"published_at":"2026-10-28T18:17:20+00:00","modified_at":"2026-10-28T18:17:20+00:00","first_seen_at":"2026-10-28T18:34:34+00:00","fetched_at":"2026-10-28T18:34:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}