Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Update to Java 8.0 Service Refresh 8 Fix Pack 70 bsc1273223. CVE-2026-16243: inconsistent handling of zero length data in arraycmp of the SIMD evaluator bsc1274275. CVE-2026-16439: using -Xtrace to trace method arguments can lead to buffer...

SUSE-SU-2026:3615-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Update to Java 8.0 Service Refresh 8 Fix Pack 70 bsc1273223. - CVE-2026-16243: inconsistent handling of zero length data in arraycmp of the SIMD evaluator bsc1274275. - CVE-2026-16439: using -Xtrace to trace method arguments can lead to...

CVE-2026-19135

A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an...

UBUNTU-CVE-2026-19135

A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an...

CVE-2026-19135

A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an...

CVE-2026-19135 OpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classes

A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an...

openjdk-orb: unauthed class loading via IIOP in EAP

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

CVE-2026-15560

The CVE-2026-15560 tracks a vulnerability in the openjdk-orb JDKBridge when EAP runs with -secmgr. The issue arises during object unmarshalling where attacker-supplied CDR codebase URLs are honoured, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL ...

CVE-2026-15560 Openjdk-orb: unauthed class loading via iiop in eap

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

CVE-2026-15560

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

Important: Red Hat Security Advisory: java-1.8.0-ibm security update

An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

java-1.8.0-ibm: Arbitrary class loading and instantiation via malicious IIOP server

A flaw was found in the ORB Object Request Broker component of IBM SDK, Java Technology Edition. A malicious IIOP Internet Inter-ORB Protocol server could exploit this vulnerability to force the loading and creation of unauthorized software components. This could lead to the execution of arbitrar...

RHEL 8 : java-1.8.0-ibm (RHSA-2026:52949)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:52949 advisory. IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. Security Fixes: Little CMS: lcms...

CVE-2026-8400

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes...

CVE-2026-8400

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes...

CVE-2026-8400

CVE-2026-8400 affects IBM WebSphere Application Server 8.5, 9.0, and WebSphere Application Server Liberty Continuous Delivery. The issue is in the ORB component of IBM SDK, Java Technology Edition, where a malicious IIOP server could cause loading and instantiation of arbitrary classes, enabling ...

CVE-2026-8400 Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes...

GHSA-WG5R-WC3X-39VC OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

Summary A pre-authentication remote code execution vulnerability affects OpenAM. The remote authentication endpoint /authservice, PLL accepts an XML element that names an arbitrary Java class, which the server then loads and instantiates without validation. On a default configuration this is...

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

Summary A pre-authentication remote code execution vulnerability affects OpenAM. The remote authentication endpoint /authservice, PLL accepts an XML element that names an arbitrary Java class, which the server then loads and instantiates without validation. On a default configuration this is...

CVE-2026-63317

Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...