CVE-2026-105115
Received Received - Intake

Unauthenticated Arbitrary Class Instantiation in OpenAM

Publication date: 2026-10-03

Last updated on: 2026-10-03

Assigner: VulnCheck

Description
OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/* with an unverified session identifier and a chosen class name, crashing the server, probing the classpath, or potentially reaching code execution via gadget chains.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-03
Last Modified
2026-10-03
Generated
2026-10-03
AI Q&A
2026-10-03
EPSS Evaluated
N/A
NVD
CVE-2026-105115
EUVD
EUVD-2026-92019

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
forgerock openam to 16.1.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenAM before version 16.1.3 has an unauthenticated arbitrary class instantiation vulnerability in its legacy JAX-RPC SOAP interface. Attackers can send SOAP requests to /jaxrpc/* with a manipulated session identifier and a chosen class name to load classes without authentication. This can crash the server, probe the classpath, or potentially lead to code execution via gadget chains.

Detection Guidance

Monitor network traffic for unexpected SOAP requests to the /jaxrpc/* endpoint. Check server logs for unusual class loading attempts or crashes. Use tools like Wireshark to inspect traffic to this path.

Impact Analysis
  • Denial of service by crashing the server.
  • Classpath probing to identify available components or libraries.
  • Potential remote code execution if gadget chains are present in the classpath.
Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR's data protection requirements or HIPAA's security and privacy rules. The potential for remote code execution and data exposure poses significant compliance risks.

Mitigation Strategies
  • Upgrade OpenAM to version 16.1.3 or later to address the vulnerability.
  • Restrict network access to the /jaxrpc/* endpoint or block it entirely if not required.
  • Monitor for unexpected SOAP requests to the /jaxrpc/* endpoint and investigate any anomalies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105115. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart