CVE-2026-46495: OpenIdentityPlatform OpenDJ deserialization RCE in JMX RMI

CVE-2026-46495 · Severity: critical · CVSS 4 · Published 2026-09-15

OpenDJ is an open-source directory service used for managing user identities and access. A critical security flaw in its monitoring component allows an unauthenticated attacker to remotely take full control of the server. This could lead to the theft of sensitive identity data, service disruption, or further unauthorized access to the corporate network.

Technologies: org.openidentityplatform.opendj:opendj-server-legacy (Maven). Vendors: Maven, Open Identity Platform.

Quick answers

Is CVE-2026-46495 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46495 being exploited in the wild.
How severe is CVE-2026-46495?
Critical severity, with a CVSS score of 4, published 15 September 2026.
Which products and versions are affected?
org.openidentityplatform.opendj:opendj-server-legacy (Maven) <= 5.1.0, ECOSYSTEM:introduced=0,fixed=5.1.1; Open Identity Platform OpenDJ Community Edition <= 5.1.0.
Is there a fix for CVE-2026-46495?
Yes. org.openidentityplatform.opendj:opendj-server-legacy (Maven): upgrade to 5.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46495 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-46495?
Check whether you run org.openidentityplatform.opendj:opendj-server-legacy (Maven) or Open Identity Platform OpenDJ Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.openidentityplatform.opendj:opendj-server-legacy (Maven): upgrade to 5.1.1 or later
    # set org.openidentityplatform.opendj:opendj-server-legacy to 5.1.1 in your pom.xml or build.gradle

Technical details

A Deserialization of Untrusted Data (CWE-502) vulnerability exists in the OpenDJ JMX RMI connector. The root cause is the platform's processing of attacker-controlled bytes prior to the authentication phase. An unauthenticated remote attacker with TCP reachability to the JMX listener can trigger the deserialization of arbitrary Java objects. Successful exploitation leads to Remote Code Execution (RCE), the impact of which depends on the available classpath gadgets (e.g., Jackson). This issue is patched in version 5.1.1.

Affected products

  • OpenIdentityPlatform OpenDJ Community Edition <= 5.1.0

Identifiers

  • CVE-2026-46495
  • GHSA-43x2-g84q-fmqx

Timeline

  • 2026-06-20: disclosed
  • 2026-06-22: advisory: GitHub Advisory published
  • 2026-06-22: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.