Oracle Linux 8 / 9 : java-1.8.0-openjdk (ELSA-2026-42877)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42877 advisory. 1:1.8.0.502.b07-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:1.8.0.502.b07-1.1 - Update to 8u502-b07 GA. - Update release notes for...

Debian dsa-6431 : openjdk-25-dbg - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6431 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6431-1 [email protected] https://www.debian.org/securit...

[SECURITY] [DSA 6431-1] openjdk-25 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6431-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 11, 2026 https://www.debian.org/security/faq -...

openjdk-orb: unauthed class loading via IIOP in EAP

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

openjdk-orb: unauthed class loading via IIOP in EAP

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...

openjdk-orb: unauthed class loading via IIOP in EAP

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...

openjdk-orb: unauthed class loading via IIOP in EAP

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

CVE-2026-15560

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

CVE-2026-15560 Openjdk-orb: unauthed class loading via iiop in eap

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

EUVD-2026-55984

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

CVE-2026-15560

The CVE-2026-15560 tracks a vulnerability in the openjdk-orb JDKBridge when EAP runs with -secmgr. The issue arises during object unmarshalling where attacker-supplied CDR codebase URLs are honoured, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL ...

CVE-2026-15560 Openjdk-orb: unauthed class loading via iiop in eap

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

CVE-2026-15560

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

CVE-2026-15560

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

PT-2026-70091

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform affected versions not specified Description When the software runs with the -secmgr flag, the JDKBridge component of openjdk-orb processes attacker-supplied CDR Common Data Representation codebase URLs...

CVE-2026-15560: Inclusion of Functionality from Untrusted Control Sphere

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

java-1.8.0-openjdk security update

1:1.8.0.502.b07-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:1.8.0.502.b07-1.1 - Update to 8u502-b07 GA. - Update release notes for 8u502-b07. - Bump lcms2 version to 2.19.1 following JDK-8321489, JDK-8348110, JDK-8375065 & JDK-8383354 - Bump zlib version to 1.3.2 following JDK-8378631 ...

openjdk: Enhance TLS certificate handling (Oracle CPU 2026-07)

A flaw was found in OpenJDK. When a server has wantClientAuth and the client sends a nocertificate alert, any client certificates are not verified...