CVE-2026-105115: OpenAM JAX-RPC SOAP RCE Vulnerability

CVE-2026-105115 Overview

CVE-2026-105115 is an unauthenticated arbitrary class instantiation vulnerability in OpenAM versions before 16.1.3. The flaw resides in the legacy Java API for XML-based Remote Procedure Calls (JAX-RPC) Simple Object Access Protocol (SOAP) interface exposed at /jaxrpc/*. Remote attackers can send SOAP requests containing an unverified session identifier and an attacker-chosen class name. The server then loads the specified class without authentication. This enables crashing the server, probing the classpath, or reaching code execution through gadget chains. The vulnerability is tracked as a Missing Authentication for Critical Function weakness [CWE-306].

Critical Impact

Unauthenticated remote attackers can trigger arbitrary class loading in OpenAM, enabling denial of service and potential remote code execution via gadget chains.

Affected Products

• OpenIdentityPlatform OpenAM versions prior to 16.1.3
• Deployments exposing the legacy JAX-RPC SOAP endpoint at /jaxrpc/*
• Any identity federation infrastructure built on vulnerable OpenAM releases

Discovery Timeline

• 2026-10-03 - CVE-2026-105115 published to the National Vulnerability Database
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105115

Vulnerability Analysis

OpenAM exposes a legacy JAX-RPC SOAP interface at /jaxrpc/* that accepts SOAP requests carrying a session identifier and a target class name. The endpoint fails to authenticate the caller before processing the request. Rather than verifying the supplied session identifier, the handler proceeds to load the requested class through Java reflection. This design violates the principle that security-sensitive operations must occur only after identity verification.

The immediate consequences include server crashes when attackers specify classes whose static initializers raise exceptions, and classpath enumeration when distinct error signatures reveal which classes are present. The more consequential outcome is remote code execution. When the deployed classpath contains known deserialization gadget chains or classes with side-effectful constructors, an attacker can chain the class load into arbitrary command execution. Identity providers like OpenAM typically broker authentication across enterprise applications, making compromise impactful.

Root Cause

The root cause is missing authentication on a critical function [CWE-306]. The JAX-RPC handler trusts the session identifier field without validating it against the session store. It then forwards the attacker-controlled class name into a reflective loader without an allowlist of permissible classes.

Attack Vector

Exploitation requires only network access to the OpenAM instance. The attacker crafts a SOAP envelope targeting /jaxrpc/*, embeds an arbitrary session token value, and specifies the target class name in the serialized payload. Because no credentials are required and the request fits within a standard HTTPS POST, the attack is scriptable and well-suited to opportunistic internet-wide scanning.

No verified public exploitation code is available at this time. Refer to the GitHub Security Advisory and the VulnCheck Security Advisory for technical details.

Detection Methods for CVE-2026-105115

Indicators of Compromise

• Unauthenticated HTTP POST requests to URIs beginning with /jaxrpc/ from external or unexpected internal sources
• SOAP envelopes containing fully qualified Java class names in request bodies targeting JAX-RPC endpoints
• OpenAM application logs showing ClassNotFoundException, NoClassDefFoundError, or reflective class-load failures tied to JAX-RPC request processing
• Unexpected JVM crashes or thread restarts in the OpenAM process correlated with inbound /jaxrpc/* traffic

Detection Strategies

• Deploy web application firewall (WAF) rules that flag SOAP requests to /jaxrpc/* carrying class names in the java.*, javax.*, com.sun.*, or known gadget-chain namespaces
• Correlate authentication log gaps with activity on the JAX-RPC endpoint; legitimate traffic should map to established sessions
• Alert on repeated requests from a single source enumerating different class names, which indicates classpath probing

Monitoring Recommendations

• Forward OpenAM access and application logs to a centralized analytics platform and retain full request URIs and user agents
• Baseline normal usage of /jaxrpc/* and alert on volume spikes or new source addresses
• Monitor outbound connections from the OpenAM host for signs of post-exploitation callbacks or secondary payload retrieval

How to Mitigate CVE-2026-105115

Immediate Actions Required

• Upgrade OpenAM to version 16.1.3 or later, which remediates the missing authentication on the JAX-RPC handler
• Restrict network access to /jaxrpc/* so that only trusted internal services can reach the endpoint
• Review authentication, session, and JVM logs for prior exploitation attempts dating back to the installation of vulnerable releases
• Rotate OpenAM administrative credentials and signing keys if compromise is suspected

Patch Information

OpenIdentityPlatform addressed the vulnerability in OpenAM 16.1.3. Review the GitHub Security Advisory GHSA-wxmx-q96f-w4gw for release details and verify binary integrity before deployment. Test the upgrade in a staging environment because legacy JAX-RPC consumers may be affected.

Workarounds

• Block or remove the /jaxrpc/* servlet mapping in the OpenAM web application descriptor if no clients depend on it
• Enforce reverse-proxy rules that drop external requests to /jaxrpc/* and permit only allowlisted internal IP ranges
• Require mutual TLS or network-level authentication in front of the OpenAM endpoint for defense in depth until the patch is applied

# Example nginx reverse-proxy block to deny external access to the vulnerable endpoint
location ~ ^/openam/jaxrpc/ {
    allow 10.0.0.0/8;
    deny all;
    return 403;
}