Which versions of OpenDJ are affected by CVE-2026-46495?

OpenDJ Community Edition through version 5.1.0 contains a critical unauthenticated remote code execution vulnerability in its JMX RMI listener that allows attackers with network access to execute…. A patch is available.

How to fix or mitigate CVE-2026-46495?

Within 24 hours: Audit network access to the JMX RMI listener (default port 9010) and identify all OpenDJ Community Edition instances running versions through 5.1.0. Within 7 days: Implement firewall rules to restrict JMX RMI listener access to authorized administrative systems only; apply network segmentation to isolate vulnerable OpenDJ deployments from untrusted networks. Within 30 days: Monitor vendor advisory for patch release; develop and test upgrade plan to post-5.1.0 versions once available, or execute endpoint replacement strategy if patch timeline is uncertain.

OpenDJ CVE-2026-46495

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-22 https://github.com/OpenIdentityPlatform/OpenDJ

GHSA-43x2-g84q-fmqx

RCE Java Deserialization

Severity by source

vuln.today AI

9.8 CRITICAL

Network-reachable JMX/RMI port, pre-authentication deserialization with no user interaction, and demonstrated RCE yielding full confidentiality, integrity, and availability impact on the host.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

CVE Published

Jun 22, 2026 - 22:00 cve.org

CRITICAL

Source Code Evidence Fetched

Jun 22, 2026 - 21:50 vuln.today

Analysis Generated

Jun 22, 2026 - 21:50 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

63 maven packages depend on org.openidentityplatform.opendj:opendj-server-legacy (8 direct, 55 indirect)

Ecosystem-wide dependent count for version 5.1.1.

DescriptionCVE.org

Summary

Description

A Deserialization of Untrusted Data (CWE-502) issue in OpenDJ's JMX RMI connector allows an unauthenticated remote attacker to deserialize arbitrary Java objects on the server. The vulnerability exists because the platform reads and processes attacker-controlled bytes prior to authentication. This affects OpenDJ Community Edition through 5.1.0. This has been patched in version 5.1.1.

Impact

This impacts all current OpenDJ releases where the JMX Connection Handler is enabled. While disabled by default, it is frequently enabled in practice for monitoring integrations. Exploitation requires TCP reachability to the configured listener and does not require authentication, prior privileges, or client certificates. Successful exploitation results in unauthenticated Remote Code Execution (RCE), with the severity depending on the runtime classpath and Java version. Unauthenticated RCE was demonstrated on the OpenDJ 4.4.15 (JDK 11 + Jackson 2.12.6.1).

Patch

This has been patched in OpenDJ Community Edition version 5.1.1. Users are encouraged to update to the latest release.

Articles & Coverage 1

News Critical RCE in OpenDJ Community Edition via JMX Deserialization - CVE-2026-46495 Jun 22, 2026

AnalysisAI

Unauthenticated remote code execution in OpenDJ Community Edition through 5.1.0 occurs when the JMX RMI connector deserializes attacker-controlled Java objects before authentication is performed. Any deployment with the JMX Connection Handler enabled (commonly turned on for monitoring integrations) is exposed to pre-auth RCE over TCP, as demonstrated against OpenDJ 4.4.15 on JDK 11 with Jackson 2.12.6.1. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

OpenDJ is an LDAPv3 directory server (a fork of OpenDS/ForgeRock OpenDJ) maintained by the Open Identity Platform community, distributed via the Maven artifact org.openidentityplatform.opendj:opendj-server-legacy. The affected component is the JMX Connection Handler, which exposes a Java Management Extensions endpoint over RMI for monitoring and management. The root cause is CWE-502 (Deserialization of Untrusted Data): the RMI transport reads serialized Java objects from the network and invokes ObjectInputStream.readObject() before the JMX authentication step runs, so any gadget chain reachable on the server classpath (e.g., via Jackson, Commons Collections, or other libraries shipped with the runtime) can be triggered to achieve code execution.

RemediationAI

Upgrade to OpenDJ Community Edition 5.1.1 or later, the vendor-released patched version per GHSA-43x2-g84q-fmqx (https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-43x2-g84q-fmqx). If immediate upgrade is not feasible, disable the JMX Connection Handler in the OpenDJ configuration (it is off by default) - note this will break any monitoring integrations that scrape JMX metrics, so plan an alternative such as LDAP-based monitoring or the cn=monitor backend. As a compensating control, restrict TCP access to the configured JMX listener port to a small set of management hosts via host firewall or network ACLs, recognizing that any host on the allowlist remains a pivot point for pre-auth RCE until the patch is applied.