CVE-2026-15560

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform (affected versions not specified)

Description When the software runs with the -secmgr flag, the JDKBridge component of openjdk-orb processes attacker-supplied CDR (Common Data Representation) codebase URLs during object unmarshalling on port :3528. This allows an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL within the server JVM before EJB security interceptors are executed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.