EUVD-2026-55984
GHSA-4238-grjh-g4xm
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AC:H reflects the dual precondition of -secmgr startup flag and exposed IIOP port 3528; PR:N because no credentials are needed once those conditions exist.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.
AnalysisAI
Remote code execution in Red Hat JBoss Enterprise Application Platform (EAP) via the openjdk-orb CORBA bridge allows unauthenticated network attackers to load and instantiate arbitrary Java classes from attacker-controlled URLs during IIOP object unmarshalling. The attack targets port 3528 and executes before EJB security interceptors are invoked, meaning EAP's own authorization layer provides no protection once the malicious payload is in flight. No public exploit or CISA KEV listing is confirmed at time of analysis, but the CWE-829 root cause class and full CIA:HHH CVSS impact reflect genuine arbitrary-code-execution potential under the required configuration.
Technical ContextAI
Red Hat JBoss EAP embeds the openjdk-orb CORBA/IIOP implementation for remote object invocation. The vulnerable component, JDKBridge, processes incoming CDR (Common Data Representation) streams on the IIOP listener port (3528). In standard CORBA/RMI-IIOP, a codebase URL embedded in a serialized object tells the receiver where to load the class definition; JDKBridge fails to restrict these URLs to trusted sources when EAP is started with the -secmgr (Security Manager) flag. CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) is the root cause: the JVM dynamically loads and instantiates classes from an attacker-supplied URL over the network, a pattern directly analogous to the legacy Java RMI codebase exploitation technique. The fact that exploitation occurs before EJB interceptors execute means in-application security controls are bypassed at the runtime level.
RemediationAI
The primary remediation is to apply the patch or updated EAP release identified in the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-15560 - the exact fix version is not confirmed in the available data and must be obtained from that advisory. Until a patch is applied, the most effective compensating control is to restrict inbound access to TCP port 3528 at the network perimeter or host firewall, preventing unauthenticated IIOP connections from reaching the vulnerable listener. If IIOP remoting is not operationally required, disabling the CORBA/IIOP subsystem in EAP configuration eliminates the attack surface entirely. If -secmgr is deployed specifically for its security hardening value and cannot be removed, the port-level restriction is the most precise mitigation that preserves EAP functionality while blocking the attack vector. Note that removing -secmgr would eliminate the precondition but also removes Security Manager enforcement, which may introduce different risks depending on the deployment.
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today