CVE-2026-46495 OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI

What is CVE-2026-46495?

CVE-2026-46495 is a critical unsafe deserialization vulnerability in OpenIdentityPlatform OpenDJ, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiConnector.java processes attacker-controlled credential objects before authentication without a restrictive jmx.remote.rmi.server.credentials.filter.pattern, and RmiAuthenticator.authenticate in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiAuthenticator.java accepts an unconstrained Object array rather than a two-element String[]. When the JMX Connection Handler is enabled and its TCP listener is reachable, an unauthenticated remote attacker can submit a crafted serialized Java object and achieve code execution in the OpenDJ server process. The handler is disabled by default, and successful exploitation depends on the runtime classpath and Java version; remote code execution was demonstrated against OpenDJ 4.4.15 on JDK 11 with Jackson 2.12.6.1. This issue is fixed in 5.1.1.

Weakness: CWE-502

Which versions are affected by CVE-2026-46495?

2 open source packages ship an affected version, including org.openidentityplatform.opendj:opendj-server-legacy.

How do I fix CVE-2026-46495?

Upgrade org.openidentityplatform.opendj:opendj-server-legacy to 5.1.1 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2026-46495 being exploited?

There is no known exploitation of CVE-2026-46495 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-43x2-g84q-fmqx.