CVE-2026-105115

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3

Description The legacy JAX-RPC SOAP interface contains an unauthenticated arbitrary class instantiation flaw. Remote attackers can send SOAP requests to the endpoint '/jaxrpc/*' using an unverified session identifier and a specific class name. This can lead to server crashes, classpath probing, or potential remote code execution through gadget chains, which are sequences of existing code fragments used to achieve an unintended goal.

Recommendations Update to version 16.1.3 or later. Restrict access to the '/jaxrpc/*' endpoint to minimize the risk of exploitation.