OpenAM EUVD-2026-92019

Requires the legacy JAX-RPC SOAP interface to be present and network-reachable at the /jaxrpc/* path on an OpenAM instance before 16.1.3; no authentication, valid session, or user interaction is needed because the session identifier is accepted unverified. Exploitation against default configurations is viable wherever this legacy interface is exposed. The primary limiting factors are: the legacy JAX-RPC endpoint must not be disabled or network-restricted, and reaching full code execution (as opposed to DoS/classpath probing) additionally requires an exploitable gadget chain to be present on the server classpath.

This is a credible high-priority issue rather than an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, fully unauthenticated attack requiring no user interaction, which aligns with the description of unauthenticated class instantiation via /jaxrpc/* and the CWE-306 (Missing Authentication) classification - these signals are internally consistent. Impact is modeled as VC:L/VI:L/VA:H, correctly emphasizing that the most reliable outcome is denial of service (crashing the server) with confidentiality/integrity impact limited to classpath probing, while full code execution is described only as a conditional 'potentially...via gadget chains' and therefore not guaranteed. No EPSS score, KEV listing, or SSVC decision data was provided in the input, and there is no POC indicator, so automatability and real-world exploitation velocity cannot be quantified. The vulnerability was reported by VulnCheck (a credible research source), which raises attention, but absence of KEV/EPSS means the signal set is skewed toward theoretical severity rather than confirmed mass exploitation; defenders should treat the DoS and classpath-disclosure outcomes as readily achievable and the RCE outcome as dependent on exploitable gadget chains present in the deployed classpath.

A remote, unauthenticated attacker sends a crafted SOAP request to the OpenAM /jaxrpc/* endpoint containing an unverified session identifier and an attacker-chosen class name, causing the server to instantiate arbitrary classes. At minimum this crashes the service or reveals which classes exist on the classpath; if a suitable deserialization/gadget chain is present, the same primitive may be escalated toward remote code execution. No public exploit code was identified in the provided data, but the low attack complexity and lack of authentication make weaponization straightforward for a skilled attacker.