# CVE-2026-105115: OpenAM unauthenticated arbitrary class instantiation in JAX-RPC

Source: https://junglewise.ai/threats/cve-2026-105115-openam-before-16-1-3-contains-an-unauthenticated-arbitrary-class  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-03. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105115 · Severity: high · CVSS 8.6 · Published 2026-10-03

OpenAM is an identity and access management platform that provides authentication and configuration services. This vulnerability in its legacy SOAP interface allows attackers from the network to load and run arbitrary code without proving their identity, potentially crashing the system or executing code with the permissions of the OpenAM process. An attacker can exploit this by sending specially crafted requests to the /jaxrpc endpoint with any Java class name, leveraging publicly known code gadgets to achieve remote code execution.

Technologies: [Open Identity Platform OpenAM](https://junglewise.ai/threats/technologies/openam). Vendors: [Open Identity Platform](https://junglewise.ai/threats/vendors/open-identity-platform).

## Quick answers

**Is CVE-2026-105115 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105115 being exploited in the wild.

**How severe is CVE-2026-105115?** High severity, with a CVSS score of 8.6, published 3 October 2026.

**Which products and versions are affected?** Open Identity Platform OpenAM before 16.1.3.

**Is there a fix for CVE-2026-105115?** Yes: fixed in 16.1.3. Until then: Restrict network access to /jaxrpc/* at the reverse proxy or firewall to only hosts running legacy remote SDK clients or agents. Block the interface entirely if the deployment does not use the legacy remote SDK. Monitor SOAP requests to /jaxrpc/* from unexpected sources. Do not expose this administrative interface to the public internet. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105115 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-105115?** Check whether you run Open Identity Platform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 16.1.3

Restrict network access to /jaxrpc/* at the reverse proxy or firewall to only hosts running legacy remote SDK clients or agents. Block the interface entirely if the deployment does not use the legacy remote SDK. Monitor SOAP requests to /jaxrpc/* from unexpected sources. Do not expose this administrative interface to the public internet.

## Technical details

The JAX-RPC SOAP interface at /jaxrpc/* accepts a Java class name parameter and instantiates it without prior authentication verification or type validation. The session identifier accepted by the operation is never validated by the server. An unauthenticated remote attacker can craft SOAP requests to load arbitrary classes from the classpath, potentially leveraging deserialization gadget chains for remote code execution, and reliably cause denial of service or classpath enumeration.

## Affected products

- Open Identity Platform OpenAM before 16.1.3

## Timeline

- 2026-09-18: disclosed
- 2026-10-03: advisory
- 2026-10-03: patched: Version 16.1.3 released

## References

- [https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-wxmx-q96f-w4gw](https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-wxmx-q96f-w4gw)
- [https://www.vulncheck.com/advisories/openam-before-16.1.3-unauthenticated-arbitrary-class-instantiation-via-jax-rpc-interface](https://www.vulncheck.com/advisories/openam-before-16.1.3-unauthenticated-arbitrary-class-instantiation-via-jax-rpc-interface)

## Related threats

- [OpenAM default credentials authentication bypass in built-in identities](https://junglewise.ai/threats/cve-2026-123553-openam-before-16-1-4-ships-built-in-identities-in-the-top-level)
- [OpenAM unauthenticated session token disclosure via WebSocket](https://junglewise.ai/threats/cve-2026-123551-openam-from-14-0-0-before-16-1-4-contains-an-information)
- [OpenAM SAML v2.0 service provider authentication bypass](https://junglewise.ai/threats/cve-2026-123550-openam-before-16-1-4-contains-an-authentication-bypass)
- [OpenAM self-registration attribute list enforcement bypass](https://junglewise.ai/threats/cve-2026-123549-openam-before-16-1-4-fails-to-enforce-the-valid-creation)
- [OpenAM open redirect via SAML RelayState](https://junglewise.ai/threats/cve-2026-123547-openam-before-16-1-4-contains-an-open-redirect-vulnerability)