Executive brief
Red Hat JBoss Enterprise Application Platform (EAP), a widely-deployed Java application server, contains a vulnerability in its ORB (Object Request Broker) component that allows unauthenticated attackers to load and execute arbitrary code on the server. When EAP is configured with security manager enabled, an attacker can supply malicious remote class URLs during object deserialization, bypassing security controls and executing code before protection measures take effect. This could lead to complete compromise of the application server and any data it manages.
Technical details
The vulnerability exists in the openjdk-orb's JDKBridge component used by JBoss EAP when running with the -secmgr security manager flag enabled. During CORBA Distributed Request (CDR) object unmarshalling on port 3528, the component fails to validate or restrict attacker-supplied codebase URLs, allowing remote code loading. An unauthenticated network attacker can craft malicious CDR messages containing arbitrary class definitions hosted on an attacker-controlled server, which are then instantiated in the server JVM before EJB security interceptors can intervene. The fix involves patching the ORB component to properly validate codebase sources and enforce security constraints during deserialization.
Affected products
- Red Hat JBoss Enterprise Application Platform <UNKNOWN>
Timeline
- 2026-08-11: disclosed