CVE-2026-46495
Received Received - Intake

JMX RMI Code Execution in OpenDJ Directory Service

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiConnector.java processes attacker-controlled credential objects before authentication without a restrictive jmx.remote.rmi.server.credentials.filter.pattern, and RmiAuthenticator.authenticate in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiAuthenticator.java accepts an unconstrained Object array rather than a two-element String[]. When the JMX Connection Handler is enabled and its TCP listener is reachable, an unauthenticated remote attacker can submit a crafted serialized Java object and achieve code execution in the OpenDJ server process. The handler is disabled by default, and successful exploitation depends on the runtime classpath and Java version; remote code execution was demonstrated against OpenDJ 4.4.15 on JDK 11 with Jackson 2.12.6.1. This issue is fixed in 5.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-46495
EUVD
EUVD-2026-78579

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
forgerock opendj 5.1.1
forgerock opendj to 5.1.1 (exc)
forgerock opendj 4.4.15
opendj opendj to 5.1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-46495 is a critical vulnerability in OpenDJ's JMX RMI connector that allows unauthenticated remote code execution via Java deserialization. The issue occurs because the JMX RMI connector processes attacker-controlled credential objects before authentication without a restrictive deserialization filter. An unauthenticated remote attacker can submit a crafted serialized Java object to achieve code execution in the OpenDJ server process if the JMX Connection Handler is enabled and its TCP listener is reachable.

Detection Guidance

Check if OpenDJ is running with JMX RMI connector enabled by inspecting running processes for OpenDJ and JMX-related ports. Use netstat or ss to verify if TCP ports associated with JMX (default 1099 or custom) are listening. Examine OpenDJ logs for JMX connection attempts or errors.

Impact Analysis

This vulnerability allows unauthenticated remote attackers to execute arbitrary code on the OpenDJ server if the JMX Connection Handler is enabled. Successful exploitation could lead to full compromise of the server, including unauthorized access to data, system manipulation, or denial of service. The attack requires only network access to the vulnerable listener.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data, leading to data breaches. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. Exploitation of this flaw could result in unauthorized disclosure, violating these regulations and potentially leading to legal penalties and reputational damage.

Mitigation Strategies
  • Upgrade OpenDJ to version 5.1.1 or later to apply the patch addressing CVE-2026-46495.
  • Disable the JMX Connection Handler if not required, as it is disabled by default and the vulnerability requires it to be enabled.
  • Apply JEP 290 deserialization filters by ensuring jmx.remote.rmi.server.credentials.filter.pattern is configured with restrictive settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46495. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart