OpenAM: Unauthenticated arbitrary class instantiation via JAX-RPC interface
Summary
OpenAM versions before 16.1.3 expose a legacy JAX-RPC SOAP interface under /jaxrpc/* that accepts a session identifier without verifying it. An unauthenticated remote attacker can make the server load and instantiate any class on its classpath by naming it in a SOAP request. This can crash the server, reveal which classes are present, and, theoretically, lead to remote code execution via gadget chains; no exploitation has been demonstrated. Exposure is highest if the interface is reachable from the internet.
Affected
- OpenAM all versions up to and including 16.1.2 (range before 16.1.3)
Fixed in
- Upgrade to OpenAM 16.1.3 or later
Workaround
- Restrict access to /jaxrpc/* at the firewall or reverse proxy to hosts that need the legacy remote SDK or agents
- Block /jaxrpc/* entirely if no component uses the legacy remote SDK
- Monitor for SOAP requests to /jaxrpc/* from unexpected sources
- The vendor publishes no workaround beyond these third-party and vendor-advisory recommendations; the vendor advisory says the interface should never be exposed to the public internet
Exploitation
- No evidence of exploitation in the wild found in public sources; not listed in the CISA KEV catalogue according to aggregator sites (KEV itself should be checked directly)
- No public proof of concept found; absence not confirmed
- CISA SSVC: exploitation none, automatable yes, technical impact partial
- Third-party EPSS value 0.00461 (low)
Our recommendation
- Identify all OpenAM instances and their versions
- Upgrade to OpenAM 16.1.3 or later; the fix shipped in September 2026, so check whether systems were already updated
- If upgrading is delayed, block or restrict /jaxrpc/* from the internet and from untrusted networks
- Review web and application logs for unusual SOAP requests to /jaxrpc/*
- Note that 16.1.2 had a separate unauthenticated RCE (CVE-2026-62379); running a current release matters more than this CVE alone
- Confirm the product and version before assessing exposure
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-wxmx-q96f-w4gw github.com
- VulnCheck advisory www.vulncheck.com
- OpenAM 16.1.3 release github.com
- OpenAM 16.1.2 release github.com
- OpenIdentityPlatform blog: OpenAM 16.1.3 released www.openidentityplatform.org
- Ionix threat center CVE-2026-105115 www.ionix.io
- Vuldb CVE-2026-105115 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:37.
Original description (NVD)
OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/* with an unverified session identifier and a chosen class name, crashing the server, probing the classpath, or potentially reaching code execution via gadget chains.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.