when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.
References
Configurations
No configuration.
History
01 Nov 2026, 01:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
25 Sep 2026, 13:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
22 Sep 2026, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
18 Sep 2026, 00:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
17 Sep 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2026-08-11 09:17
Updated : 2026-11-01 01:17
NVD link : CVE-2026-15560
Mitre link : CVE-2026-15560
CVE.ORG link : CVE-2026-15560
JSON object : View
Products Affected
No product.
CWE
CWE-829
Inclusion of Functionality from Untrusted Control Sphere
