CVE-2026-15560: OpenJDK ORB JDKBridge RCE Vulnerability

CVE-2026-15560 Overview

CVE-2026-15560 is a remote class loading vulnerability in the openjdk-orb component shipped with Red Hat JBoss Enterprise Application Platform (EAP). When EAP runs with the -secmgr flag, the JDKBridge class honours attacker-supplied Common Data Representation (CDR) codebase URLs during object unmarshalling on TCP port 3528. An unauthenticated attacker can force the server Java Virtual Machine (JVM) to load and instantiate arbitrary classes from a remote URL before Enterprise JavaBeans (EJB) security interceptors run. The flaw is classified as [CWE-829: Inclusion of Functionality from Untrusted Control Sphere].

Critical Impact
An unauthenticated remote attacker can achieve arbitrary class loading and instantiation in the server JVM, resulting in code execution before authentication checks occur.

Affected Products

Red Hat JBoss Enterprise Application Platform (EAP) deployments running with the -secmgr option
The bundled openjdk-orb Object Request Broker component (JDKBridge)
EAP instances exposing the IIOP listener on TCP port 3528

Discovery Timeline

2026-08-11 - CVE-2026-15560 published to the National Vulnerability Database (NVD)
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-15560

Vulnerability Analysis

The defect lives in the JDKBridge component of the openjdk-orb library used by JBoss EAP's Internet Inter-ORB Protocol (IIOP) stack. During unmarshalling of CDR-encoded objects, the bridge reads a codebase attribute supplied by the peer and uses it as a source for class resolution. When EAP is launched with -secmgr, the ORB code path still honours these attacker-controlled URLs and delegates class loading to a URLClassLoader pointed at the remote location.

Because the class is resolved and instantiated during deserialization on port 3528, the malicious class executes before any EJB security interceptor evaluates the caller's identity. This turns a pre-authentication IIOP request into arbitrary code execution inside the application server JVM.

Root Cause

The root cause is unsafe inclusion of functionality from an untrusted control sphere. The JDKBridge treats the CDR codebase field as trusted metadata, allowing remote HTTP or FTP URLs to define where classes are fetched. No allow-list, signature check, or authentication gate is applied prior to class resolution.

Attack Vector

Exploitation occurs over the network against the IIOP listener on TCP 3528. The attacker sends a crafted CDR-encoded object referencing a remote codebase URL under their control. The vulnerable server contacts that URL, downloads a class file, defines it in the server JVM, and instantiates it — all before EJB interceptors fire. No credentials are required. See the Red Hat Security Advisory RHSA-2026:53644 and Red Hat CVE Details for CVE-2026-15560 for vendor guidance.

Detection Methods for CVE-2026-15560

Indicators of Compromise

Inbound TCP connections to port 3528 from untrusted or unexpected source addresses.
Outbound HTTP, HTTPS, or FTP requests from the EAP JVM process to unfamiliar hosts immediately after IIOP traffic.
New anonymous class definitions or unusual URLClassLoader activity in JVM diagnostic logs.
EAP server logs showing IIOP unmarshalling entries followed by unexpected class instantiations.

Detection Strategies

Inspect network telemetry for IIOP or General Inter-ORB Protocol (GIOP) traffic containing codebase URL fields sourced from external hosts.
Correlate inbound port 3528 activity with subsequent outbound egress from the JBoss process to spot remote class fetches.
Enable Java Security Manager audit logging and monitor for defineClass or URLClassLoader invocations on the IIOP thread pool.

Monitoring Recommendations

Alert on egress from JBoss EAP hosts to non-corporate URLs, particularly HTTP GET requests for .class or .jar resources.
Baseline expected IIOP peers and flag deviations, especially from internet-facing segments.
Forward EAP server.log and JVM garbage collection or class loader logs to a centralized analytics platform for anomaly review.

How to Mitigate CVE-2026-15560

Immediate Actions Required

Apply the fixes referenced in RHSA-2026:53644 and RHSA-2026:53806 to affected JBoss EAP installations.
Restrict network access to TCP port 3528 so only trusted IIOP clients can reach the listener.
Audit EAP startup parameters and inventory hosts running with the -secmgr flag.
Block outbound egress from EAP JVMs to arbitrary internet destinations until patching completes.

Patch Information

Red Hat has released updated openjdk-orb packages through the security advisories RHSA-2026:53644 and RHSA-2026:53806. Consult the Red Hat Bug Report #2483131 for tracking details and version-specific fix information.

Workarounds

Disable the IIOP subsystem in EAP if remote object invocation is not required.
Firewall port 3528 at the perimeter and internal segmentation boundaries.
Configure network egress controls so the JVM cannot reach untrusted HTTP or FTP endpoints that could host malicious class files.
Where the -secmgr flag is not required, review whether it can be removed as part of a hardening review.

bash

# Configuration example: block IIOP port 3528 at the host firewall
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" port port="3528" protocol="tcp" reject'
sudo firewall-cmd --reload