CVE-2026-84725
High · 8.1CVSS
8.1
EPSS
0.3%
Published
Oct 28, 2026
CISA due date
—
The record
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63184 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-829
- CVE-2026-118762 Monkeytype is a minimalistic and customizable typing test. CWE-829
- CVE-2023-7357 A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher… CWE-829
- CVE-2026-15564 Wildfly's IIOP listener may permit deserialization of input streams before authentication… CWE-829
- CVE-2026-114488 A flaw was found in Wildfly. CWE-829
- CVE-2026-59172 Joker is a small Clojure interpreter, linter and formatter written in Go. CWE-829
- CVE-2026-59176 Functype is a family of TypeScript functional programming libraries. CWE-829
- CVE-2026-65119 NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter… CWE-829