High severity8.1NVD Advisory· Published Aug 11, 2026· Updated Sep 18, 2026
CVE-2026-15560
CVE-2026-15560
Description
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
6News mentions
0No linked articles in our index yet.