PT-2026-139824

CVE-2026-123543

Published

2026-11-08

Updated

2026-11-11

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.4

Description An issue allows unauthenticated attackers to cause a denial of service by sending serialized Java data without size or structure limits, leading to server resource exhaustion. Attackers can send crafted requests to remote SDK endpoints, classic login pages, or the administration console to block session validation, authentication, and policy decisions.

Recommendations Update to version 16.1.4.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors