Advisory · CVE-2026-84725
Remote class loading in JBoss EAP openjdk-orb bypasses EJB security
When EAP runs with secmgr, an unauthenticated attacker can make the openjdk-orb load arbitrary classes from a remote URL into the server JVM. Red Hat rates it 8.1.
- Vendor
- Red Hat
- Product
- Red Hat JBoss Enterprise Application Platform
- Identifier / CWE
- CVE-2026-84725
CWE-829 - Action timing
- Immediate
Explain it like I’m five
The server is told to fetch a class from an address the attacker supplies, and it does so before the security guards get a chance to object.
- 01Attacker-supplied codebase URL
An unauthenticated attacker supplies a CDR codebase URL during object unmarshalling on port 3528.
- 02Class loading
The JDKBridge honours the URL and loads and instantiates arbitrary classes from the remote location in the server JVM.
- 03Security bypass
This happens before EJB security interceptors run, so the usual checks never apply.
What happened
Red Hat disclosed a flaw in the openjdk-orb component of JBoss Enterprise Application Platform 7 and 8. When EAP runs with secmgr, the JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on port 3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run. Red Hat rates it 8.1 with high attack complexity.
The NVD record does not state fixed versions, so teams should follow the Red Hat advisory for the corrected build. The secmgr precondition narrows exposure to EAP deployments running with the security manager enabled.
What to do
- Inventory JBoss EAP 7 and 8 deployments running with secmgr.
- Apply the fix from the Red Hat advisory.
- Restrict network access to port 3528 and the ORB listener until patched.
- Review server logs for unusual codebase URLs or unexpected class loading.
- Confirm the deployed build after patching.
Management note
Remote class loading that runs ahead of security interceptors is a fundamental deserialization failure. The secmgr precondition limits the blast radius, but any matching deployment is remotely reachable code execution.