Which versions of OpenDJ are affected by CVE-2026-46495?

OpenDJ Community Edition (versions 5.1.0 and earlier) contains a critical unauthenticated remote code execution vulnerability in its JMX monitoring interface that allows any network-adjacent attacker…. A patch is available.

How to fix or mitigate CVE-2026-46495?

Within 24 hours: identify all systems running OpenDJ Community Edition 5.1.0 or earlier and determine network reachability to the JMX listener (default port 9010). Within 7 days: apply the vendor-released patch to all affected OpenDJ instances, verify successful deployment, and immediately restrict firewall access to JMX ports to only trusted administrative networks. Within 30 days: conduct complete inventory audit confirming patch coverage across all environments, implement network segmentation isolating directory servers from general network access, and deploy detection rules for unauthorized JMX connection attempts.

OpenDJ CVE-2026-46495

Q: What is the CVSS score of CVE-2026-46495?

CVE-2026-46495 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-78579 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-22 https://github.com/OpenIdentityPlatform/OpenDJ

GHSA-43x2-g84q-fmqx

RCE Java Deserialization

9.2

CVSS 4.0 · Vendor: https://github.com/OpenIdentityPlatform/OpenDJ

Severity by source

Vendor (https://github.com/OpenIdentityPlatform/OpenDJ) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Pre-auth network-reachable deserialization gives AV:N/PR:N/UI:N and full C/I/A on the JVM; kept AC:L per the code path, though real-world exposure is gated by the non-default JMX handler and classpath.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/OpenIdentityPlatform/OpenDJ).

CVSS VectorVendor: https://github.com/OpenIdentityPlatform/OpenDJ

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Sep 15, 2026 - 15:29 vuln.today

v3 (cvss_changed)

Re-analysis Queued

Sep 15, 2026 - 15:22 vuln.today

cvss_changed

CVSS changed

Sep 15, 2026 - 15:22 NVD

9.2 (CRITICAL)

CVE Published

Jun 22, 2026 - 22:00 cve.org

CRITICAL

Source Code Evidence Fetched

Jun 22, 2026 - 21:50 vuln.today

Analysis Generated

Jun 22, 2026 - 21:50 vuln.today

DescriptionCVE.org

Summary

Description

A Deserialization of Untrusted Data (CWE-502) issue in OpenDJ's JMX RMI connector allows an unauthenticated remote attacker to deserialize arbitrary Java objects on the server. The vulnerability exists because the platform reads and processes attacker-controlled bytes prior to authentication. This affects OpenDJ Community Edition through 5.1.0. This has been patched in version 5.1.1.

Impact

This impacts all current OpenDJ releases where the JMX Connection Handler is enabled. While disabled by default, it is frequently enabled in practice for monitoring integrations. Exploitation requires TCP reachability to the configured listener and does not require authentication, prior privileges, or client certificates. Successful exploitation results in unauthenticated Remote Code Execution (RCE), with the severity depending on the runtime classpath and Java version. Unauthenticated RCE was demonstrated on the OpenDJ 4.4.15 (JDK 11 + Jackson 2.12.6.1).

Patch

This has been patched in OpenDJ Community Edition version 5.1.1. Users are encouraged to update to the latest release.

Articles & Coverage 1

News Critical RCE in OpenDJ Community Edition via JMX Deserialization - CVE-2026-46495 Jun 22, 2026

AnalysisAI

Unauthenticated remote code execution in Open Identity Platform's OpenDJ Community Edition (through 5.1.0) arises from Java deserialization of untrusted data in the JMX RMI connector, which reads and processes attacker-controlled bytes before authentication. Any attacker with TCP reachability to the configured JMX listener can deliver a malicious serialized object gadget chain and execute code on the directory server; the vendor demonstrated working RCE on OpenDJ 4.4.15 (JDK 11 + Jackson 2.12.6.1). No CISA KEV listing and no public exploit code identified at time of analysis, though a vendor proof-of-concept demonstration is documented in the advisory.

Technical ContextAI

OpenDJ is a Java-based LDAP directory server (an Open Identity Platform community fork of ForgeRock/Sun OpenDJ), distributed via the Maven artifact org.openidentityplatform.opendj:opendj-server-legacy. The affected surface is its JMX Connection Handler, which exposes remote management over Java RMI. The root cause is CWE-502 (Deserialization of Untrusted Data): the RMI connector's pre-authentication credential-handling path (RmiAuthenticator.authenticate) accepted and cast an arbitrary deserialized Object[] before validating the caller, so the JVM materialized attacker-supplied classes during unmarshalling. If exploitable gadget classes are present on the runtime classpath (e.g., Jackson databind and similar libraries), that deserialization is turned into arbitrary code execution. The fix (PR #651, commits 7e3a759 and d4a95c2) adds a strict credential type check (only a two-element String[] is accepted) and installs a JEP 290 credentials-scoped deserialization filter ('maxdepth=3;maxarray=2;java.lang.String;!*') plus a jmx.remote.rmi.server.credential.types allowlist, scoped to credentials so legitimate MBean traffic is unaffected.

RemediationAI

Vendor-released patch: upgrade to OpenDJ Community Edition 5.1.1, which enforces a strict two-element String[] credential type and applies a credentials-scoped JEP 290 deserialization filter (commits 7e3a75903159153c877daeb2952a552701e38044 and d4a95c2e37c375756f9829c7ec43a4785b99e2e2, PR https://github.com/OpenIdentityPlatform/OpenDJ/pull/651, release https://github.com/OpenIdentityPlatform/OpenDJ/releases/tag/5.1.1). If immediate patching is not possible, disable the JMX Connection Handler entirely if it is not required (it is off by default and removes the attack surface completely, at the cost of losing JMX-based monitoring integrations); where JMX must remain enabled, restrict TCP reachability to the JMX listener with host or network firewall rules so only trusted management hosts can connect, and consider applying a JVM-wide JEP 290 deserialization filter via jdk.serialFilter to reject untrusted classes (test carefully, as an overly broad filter can break legitimate JMX MBean traffic). Full details are in advisory GHSA-43x2-g84q-fmqx (https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-43x2-g84q-fmqx).