Red Hat JBoss EAP CVE-2026-84725

Exploitation requires the target JBoss EAP (7 or 8) to be started with the -secmgr flag and to have the CORBA/IIOP ORB (openjdk-orb) active with its CDR listener reachable on TCP 3528. The attacker must be able to send a CDR-encoded object carrying an attacker-controlled codebase URL that the JDKBridge honours during unmarshalling; no authentication is required (PR:N), and the malicious class loads before EJB security interceptors run. Limiting factors: the -secmgr mode is non-default (and, notably, is itself a hardening option), the IIOP/CDR listener must be network-exposed rather than firewalled, and the CVSS AC:H plus the 'this_week' decision label reflect that these preconditions, not default deployments, gate the attack.

This is a credible high-severity threat but not a drop-everything emergency, and the signals are partly incomplete. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) describes a network-reachable, unauthenticated flaw (PR:N) with full CIA impact - effectively remote code execution via arbitrary class loading - but with high attack complexity (AC:H), which the description grounds in a specific precondition: EAP must be running with -secmgr and must expose the CORBA/IIOP listener. The vuln.today decision label is 'this_week', consistent with a serious but conditional issue rather than act_now/emergency. No EPSS score was provided, so exploitation probability cannot be quantified. There is no CISA KEV listing and no PoC or exploit reference in the input, so this is no public exploit identified at time of analysis - do not treat it as actively exploited. A notable cross-reference tension: the -secmgr flag is normally a hardening measure (enabling the Java Security Manager), yet here it is the prerequisite that exposes the JDKBridge codebase-loading path, so environments that enabled it for defense-in-depth are the ones at risk. Net: real priority for JBoss EAP operators running IIOP with -secmgr, lower practical risk for the majority of deployments that do not.

An unauthenticated attacker who can reach the IIOP/CDR listener on TCP 3528 of a JBoss EAP instance started with -secmgr sends a crafted CDR-encoded object whose codebase points to an attacker-controlled URL. During unmarshalling, the openjdk-orb JDKBridge honours that URL and loads and instantiates an arbitrary remote class inside the server JVM before EJB security interceptors run, yielding code execution. No public exploit code is identified in the available sources; the high attack complexity reflects the required non-default -secmgr configuration and exposed ORB listener.