CVE-2026-33439 Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM
Unauthenticated attackers can execute arbitrary code on OpenAM servers by sending malicious serialized Java objects via the jato.clientSession parameter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33439?
CVE-2026-33439 is a critical unsafe deserialization vulnerability in OpenIdentityPlatform OpenAM, published on 7 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains <jato:form> tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6.
Weakness: CWE-502
Which versions are affected by CVE-2026-33439?
2 open source packages ship an affected version, including org.openidentityplatform.openam:openam. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.openidentityplatform.openam:openam Maven | All versions | 16.0.6 |
org.openidentityplatform.openam:openam Maven | All versions | 16.0.6 |
Products include Openidentityplatform Openam.
How do I fix CVE-2026-33439?
Upgrade org.openidentityplatform.openam:openam to 16.0.6 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-33439 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33439 exists.
Public exploit code: 1 Nuclei template and 8 proofs of concept on GitHub.
Other vulnerabilities in OpenIdentityPlatform OpenAM
Sources
Also known as GHSA-2cqq-rpvq-g5qj.