Unauthenticated Remote Code Execution in Red Hat JBoss EAP via openjdk-orb

CVE-2026-15560 is a critical security flaw affecting Red Hat JBoss Enterprise Application Platform (EAP) when the security manager is enabled via the '-secmgr' flag. The vulnerability resides within the openjdk-orb's JDKBridge component. During the process of object unmarshalling on port 3528, the JDKBridge component fails to properly validate codebase URLs provided within Common Data Representation (CDR) streams.

An unauthenticated remote attacker can supply a malicious URL containing a crafted class definition. Because this process occurs before EJB security interceptors are initialized, the server JVM will load and instantiate arbitrary classes from the remote location, leading to Remote Code Execution (RCE). This vulnerability is particularly dangerous as it bypasses standard EJB-level security controls, effectively granting the attacker the privileges of the JBoss application server process.

Impact

Successful exploitation allows for full remote code execution within the context of the JBoss EAP server process. This can lead to total system compromise, unauthorized data access, and lateral movement within the enterprise network. Organizations running EAP instances with the '-secmgr' configuration are at the highest risk.

Recommendation

• Identify all JBoss EAP instances currently running with the '-secmgr' flag in your environment.
• Apply the vendor-provided patch or update to the version of JBoss EAP that addresses CVE-2026-15560.
• Monitor network traffic directed to port 3528 for unexpected outbound connections from the JBoss server to external hosts, which may indicate an attempt to fetch remote class files for instantiation.