CVE-2026-105115 OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface
Remote attackers can exploit unauthenticated class instantiation in OpenAM's JAX-RPC interface to achieve code execution or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-105115?
CVE-2026-105115 is a high-severity code injection vulnerability in OpenIdentityPlatform OpenAM, published on 3 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/* with an unverified session identifier and a chosen class name, crashing the server, probing the classpath, or potentially reaching code execution via gadget chains.
Weakness: CWE-306
Which versions are affected by CVE-2026-105115?
How do I fix CVE-2026-105115?
No fix has been published for CVE-2026-105115 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-105115 being exploited?
There is no known exploitation of CVE-2026-105115 in the wild and no public exploit code.
Sources
Also known as GHSA-45wm-hvw4-223f, GHSA-wxmx-q96f-w4gw.