Remote Code Execution Vulnerability in OpenDJ Directory Service by OpenIdentityPlatform

CVE-2026-46495

What is CVE-2026-46495?

The OpenDJ directory service is affected by a vulnerability that allows unauthenticated remote attackers to execute arbitrary code. An issue in the JMX RMI connector allows attackers to control credential objects before proper authentication. By submitting crafted serialized Java objects, an attacker can exploit the JMX Connection Handler to compromise the OpenDJ server process. This vulnerability is dependent on the runtime classpath and the Java version in use, with effective exploitation demonstrated against version 4.4.15 on JDK 11. The vulnerability has been addressed in version 5.1.1, in which the JMX Connection Handler is disabled by default for enhanced security.

References