CVE-2026-15560

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.
Configurations

No configuration.

History

01 Nov 2026, 01:17

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2026:53645', 'source': 'secalert@redhat.com'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2026:53646', 'source': 'secalert@redhat.com'}

25 Sep 2026, 13:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:70277 -

22 Sep 2026, 16:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:70228 -
  • () https://access.redhat.com/errata/RHSA-2026:70229 -
  • () https://access.redhat.com/errata/RHSA-2026:70230 -

18 Sep 2026, 00:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:53646 -

17 Sep 2026, 19:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:53645 -

Information

Published : 2026-08-11 09:17

Updated : 2026-11-01 01:17


NVD link : CVE-2026-15560

Mitre link : CVE-2026-15560

CVE.ORG link : CVE-2026-15560


JSON object : View

Products Affected

No product.

CWE
CWE-829

Inclusion of Functionality from Untrusted Control Sphere