CVE-2026-84725 - Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap
CVE ID :CVE-2026-84725 Published : Oct. 28, 2026, 5:30 p.m. | 54 minutes ago Description :when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate...