IT SBIT Services
Schneeberger
DEEN
CVE tracker

Red Hat JBoss EAP: Unauthenticated class loading via IIOP in openjdk-orb

CVE-2026-84725High 8.1

← All vulnerabilities

Summary

The openjdk-orb component of Red Hat JBoss Enterprise Application Platform (EAP) 7 and 8 accepts attacker-supplied CDR codebase URLs during object unmarshalling on TCP port 3528 (IIOP). This applies only when EAP runs with the Java Security Manager (-secmgr) and the IIOP service is reachable from the attacker's network. An unauthenticated remote attacker can load and instantiate arbitrary classes from a remote URL in the server JVM before the EJB security interceptors run, which Red Hat rates as Important and states can lead to remote code execution. Red Hat describes this issue as an incomplete fix for CVE-2026-15560.

Affected

  • Red Hat JBoss Enterprise Application Platform 7 (default: affected)
  • Red Hat JBoss Enterprise Application Platform 8 (default: affected)
  • Only deployments running with -secmgr and an exposed IIOP service on TCP port 3528
  • Exact affected builds: Unknown.

Fixed in

  • Unknown. No fixed version or erratum for CVE-2026-84725 has been confirmed.
  • Related errata for CVE-2026-15560 exist (e.g. RHSA-2026:70277 for EAP 8.1), but their coverage of CVE-2026-84725 is not confirmed.

Workaround

  • Restrict access to TCP port 3528 to trusted networks using firewall rules (e.g. firewall-cmd --permanent --remove-port=3528/tcp, then firewall-cmd --reload).
  • Or disable the IIOP subsystem (iiop-openjdk) if CORBA is not required; a full server restart is required after removing it.
  • Caveat: blocking port 3528 or disabling IIOP prevents legitimate remote IIOP/CORBA clients from connecting.

Exploitation

  • Not known to be exploited in the wild (OffSeq, as of 28 Oct 2026).
  • Not listed in CISA KEV according to a secondary source; not confirmed on cisa.gov.
  • No public proof of concept found in the research.

Our recommendation

  • Check whether any EAP instance runs with -secmgr and whether port 3528 is reachable from untrusted networks.
  • Block TCP 3528 from untrusted networks and from the internet, after confirming no required services depend on IIOP.
  • Apply the current openjdk-orb errata for your EAP stream and check the Red Hat CVE page for a fix specific to CVE-2026-84725.
  • Monitor the Red Hat advisory and EAP logs for unexpected remote class loading.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:51.

Original description (NVD)

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed