CVE-2026-84725

CVSS 8.1 (high) · published 2026-10-28

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

Weakness: CWE-829

Source: NVD CVE-2026-84725

References

• https://access.redhat.com/errata/RHSA-2026:95887
• https://access.redhat.com/errata/RHSA-2026:99096
• https://access.redhat.com/errata/RHSA-2026:99097
• https://access.redhat.com/errata/RHSA-2026:99098
• https://access.redhat.com/errata/RHSA-2026:99099
• https://access.redhat.com/security/cve/CVE-2026-84725
• https://bugzilla.redhat.com/show_bug.cgi?id=2527228

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.