Public vulnerability disclosure
CVE-2026-84725
Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap
publishedCWE-829
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.
Technical severity8.1 highCVSS 3.1 · CNA: redhat
Published2026-10-28Source updated 2026-11-11
Collected2026-11-113 attributed sources
Fixes and workarounds
Workaround
To mitigate this flaw, restrict access to the IIOP service (TCP port 3528) to trusted networks using firewall rules, or disable the IIOP subsystem if CORBA is not required by deployed applications. To restrict or remove external access to port 3528 using firewalld: ``` firewall-cmd --permanent --remove-port=3528/tcp firewall-cmd --reload ``` Warning: Reloading the firewall configuration may briefly interrupt network traffic. If removing the iiop-openjdk subsystem from the JBoss EAP configuration (standalone.xml or domain.xml), a full server restart is required, causing temporary service downtime. Caveats: Blocking port 3528 or disabling the IIOP subsystem will prevent legitimate remote clients from communicating over IIOP/CORBA
Source: CNA: redhatAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform 7.4 Red Hat openjdk-orb
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Red Hat eap7-apache-cxf
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:3.5.11-2.SP2_redhat_00001.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Red Hat eap7-jackson-annotations
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.18.10-1.redhat_00001.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Red Hat eap7-jackson-core
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.18.10-1.redhat_00001.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Red Hat eap7-jackson-databind
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.18.10-1.redhat_00001.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Red Hat eap7-jackson-jaxrs-providers
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.18.10-1.redhat_00001.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Red Hat eap7-jackson-modules-base
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.18.10-1.redhat_00001.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Red Hat eap7-jackson-modules-java8
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.18.10-1.redhat_00001.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Red Hat eap7-jboss-server-migration
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.10.0-47.Final_redhat_00045.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Red Hat eap7-jbossws-cxf
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:5.4.18-1.Final_redhat_00001.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Red Hat eap7-undertow
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.2.40-3.SP4_redhat_00001.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Red Hat eap7-wildfly
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:7.4.26-5.GA_redhat_00002.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Red Hat eap7-wildfly-elytron
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.15.30-1.Final_redhat_00001.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 Red Hat eap7-apache-cxf
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:3.5.11-2.SP2_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 Red Hat eap7-jackson-annotations
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.18.10-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 Red Hat eap7-jackson-core
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.18.10-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 Red Hat eap7-jackson-databind
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.18.10-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 Red Hat eap7-jackson-jaxrs-providers
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.18.10-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 Red Hat eap7-jackson-modules-base
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.18.10-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 Red Hat eap7-jackson-modules-java8
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.18.10-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 Red Hat eap7-jboss-server-migration
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.10.0-47.Final_redhat_00045.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 Red Hat eap7-jbossws-cxf
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:5.4.18-1.Final_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 Red Hat eap7-undertow
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.2.40-3.SP4_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 Red Hat eap7-wildfly
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:7.4.26-5.GA_redhat_00002.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 Red Hat eap7-wildfly-elytron
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.15.30-1.Final_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 Red Hat eap7-apache-cxf
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:3.5.11-2.SP2_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 Red Hat eap7-jackson-annotations
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.18.10-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 Red Hat eap7-jackson-core
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.18.10-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 Red Hat eap7-jackson-databind
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.18.10-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 Red Hat eap7-jackson-jaxrs-providers
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.18.10-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 Red Hat eap7-jackson-modules-base
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.18.10-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 Red Hat eap7-jackson-modules-java8
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.18.10-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 Red Hat eap7-jboss-server-migration
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.10.0-47.Final_redhat_00045.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 Red Hat eap7-jbossws-cxf
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:5.4.18-1.Final_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 Red Hat eap7-undertow
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.2.40-3.SP4_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 Red Hat eap7-wildfly
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:7.4.26-5.GA_redhat_00002.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 Red Hat eap7-wildfly-elytron
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.15.30-1.Final_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 Red Hat openjdk-orb
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 8.1 high |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | CNA: redhat |
| 3.1 / 8.1 high |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD: [email protected] |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://access.redhat.com/errata/RHSA-2026:95887CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:99096CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:99097CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:99098CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:99099CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-84725CNA: redhat · vdb-entry, x_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2527228CNA: redhat · issue-tracking, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:95887[email protected]
- https://access.redhat.com/security/cve/CVE-2026-84725[email protected]
- https://bugzilla.redhat.com/show_bug.cgi?id=2527228[email protected]
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.