Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.new Create a CVE report
Check your stack
CVE-2026-84725high8.1

Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap

Impact

Openjdk-orb in Red Hat JBoss Enterprise Application Platform 7 and 8 has an incomplete fix for CVE-2026-15560, allowing unauthenticated class loading via IIOP. An attacker can load arbitrary classes from a remote URL in the server JVM. The weakness is due to inclusion of functionality from an untrusted control sphere.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.

What to do

To mitigate this flaw, restrict access to the IIOP service (TCP port 3528) to trusted networks using firewall rules, or disable the IIOP subsystem if CORBA is not required by deployed applications.

To restrict or remove external access to port 3528 using firewalld:

firewall-cmd --permanent --remove-port=3528/tcp
firewall-cmd --reload

Warning: Reloading the firewall configuration may briefly interrupt network traffic. If removing the iiop-openjdk subsystem from the JBoss EAP configuration (standalone.xml or domain.xml), a full server restart is required, causing temporary service downtime.

Caveats: Blocking port 3528 or disabling the IIOP subsystem will prevent legitimate remote clients from communicating over IIOP/CORBA.

redhat guidance

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

Red Hat · redhat

Red Hat JBoss Enterprise Application Platform 7

0 ranges
redhat version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

unaffected

unknown

Other versions: affected

Product identifiers (CPE)cpe:/a:redhat:jboss_enterprise_application_platform:7

Red Hat · redhat

Red Hat JBoss Enterprise Application Platform 8

0 ranges
redhat version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

unaffected

unknown

Other versions: affected

Product identifiers (CPE)cpe:/a:redhat:jboss_enterprise_application_platform:8

Original source description

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

Inside the record

Evidence available

Package identity · not supplied
Version evidence · not supplied
Remediation guidance
Weakness classification
Additional publishers · not supplied

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-84725

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-829 ↗

Inclusion of Functionality from Untrusted Control Sphere

redhat

Related →
Contributing organizations · 1
redhat

Assigning organization

2026-10-28

What changed

Follow changes
No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.

References

2 sources
access.redhat.com/security/cve/CVE-2026-84725
vdb-entryredhat
bugzilla.redhat.com/show_bug.cgi
issue-trackingredhat