---
id: "CVE-2026-84725"
kind: "vulnerability"
aliases: ["CVE-2026-84725"]
title: "JBoss EAP: unauthenticated remote class loading via CDR codebase URLs"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ejb", "java", "jboss-eap", "runtime", "self-hosted"]
not_affected_if: ["default-config", "no-secmgr"]
published_at: "2026-10-28T18:17:20+00:00"
first_seen_at: "2026-10-28T18:34:34+00:00"
updated_at: "2026-10-28T18:34:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84725", "first_seen_at": "2026-10-28T18:34:34+00:00"}]
---

# JBoss EAP: unauthenticated remote class loading via CDR codebase URLs

When JBoss EAP runs with the -secmgr flag, the OpenJDK ORB's JDKBridge accepts attacker-supplied codebase URLs during CORBA object unmarshalling on port 3528. An unauthenticated attacker can make the server JVM load and instantiate arbitrary classes from a remote URL before EJB security checks run.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the server starts with `-secmgr` in its startup arguments or `standalone.conf`
- Check whether port `3528` (IIOP) is reachable from untrusted networks
- Check the installed EAP version against the fixed release listed in the advisory

## Fix

- Apply the vendor patch for the affected JBoss EAP release (exact versions unknown from the sources)
- Remove `-secmgr` from the startup configuration if the security manager is not required
- Block port `3528` at the network edge if IIOP is not needed

## Timeline

- 2026-10-28T18:34:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-84725

## From the sources

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_