CVE-2026-15560
Received Received - Intake

Remote Code Execution in OpenJDK Orb JDKBridge

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: Red Hat, Inc.

Description
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-15560
EUVD
EUVD-2026-55984

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
red_hat openjdk-orb *
red_hat jboss_eap *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-829 The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability occurs in Red Hat's openjdk-orb component when used with JBoss EAP running in -secmgr mode. The JDKBridge in openjdk-orb accepts attacker-controlled CDR codebase URLs during object unmarshalling on port 3528. This allows an unauthenticated attacker to remotely load and instantiate arbitrary classes in the server's JVM before EJB security interceptors run.

Detection Guidance

Check if port 3528 is open and listening on systems running openjdk-orb with EAP in -secmgr mode. Use network scanning tools like nmap to detect open ports. Inspect logs for unusual IIOP or CDR unmarshalling activity on port 3528.

Impact Analysis

An attacker could exploit this to execute arbitrary code on the server, potentially leading to full system compromise. This includes stealing sensitive data, modifying system behavior, or disrupting services. The attack requires no authentication and can be performed remotely over the network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Disable or restrict access to port 3528 on affected systems. Apply patches or updates from Red Hat if available. Consult Red Hat's official documentation for product-specific mitigations. Consider disabling -secmgr mode if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15560. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart