Remote Code Execution Vulnerability in OpenJDK ORB - Red Hat
CVE-2026-15560
8.1HIGH
Key Information:
What is CVE-2026-15560?
A vulnerability exists in OpenJDK ORB when run with the -secmgr option. This flaw permits an unauthenticated attacker to supply malicious codebase URLs during object unmarshalling. As a result, the attacker can load and instantiate arbitrary Java classes from a remote URL before EJB security interceptors are triggered, potentially leading to unauthorized actions within the server environment.
Affected Version(s)
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:2.16.0-22.redhat_00057.1.el7eap
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:2.3.14-11.SP11_redhat_00001.1.el7eap
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:1.5.26-2.Final_redhat_00001.1.el7eap