JBoss Enterprise Application Platform: Remote code execution via JDKBridge (CVE-2026-84725)
An unauthenticated remote code execution vulnerability in JBoss EAP allows attackers to instantiate arbitrary classes from a remote URL when the server is configured with the -secmgr flag.
CVE search metadata
CVE search record: CVE-2026-84725. Severity: high. CVSS: 8.1. KEV: no. Product: JBoss Enterprise Application Platform. Brief: JBoss Enterprise Application Platform: Remote code execution via JDKBridge (CVE-2026-84725). Brief link: https://feed.craftedsignal.io/briefs/2026-10-cve-2026-84725/
Triage facts
Revision 1- Applicability
- JBoss Enterprise Application Platform
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 28, 18:37 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
CVE-2026-84725 is a remote code execution vulnerability in the openjdk-orb's JDKBridge component within JBoss Enterprise Application Platform (EAP). The flaw occurs during object unmarshalling on port 3528 when the server is executed with the -secmgr security manager flag. An unauthenticated attacker can supply a malicious CDR (Common Data Representation) codebase URL, forcing the server to load and execute arbitrary classes before EJB security interceptors are processed.
Impact
Successful exploitation allows for unauthenticated remote code execution within the server JVM context. This bypasses application-level security interceptors, potentially granting the attacker full control over the application process and underlying server resources.
Recommendation
- Immediately audit JBoss EAP configurations to identify instances running with the -secmgr startup flag.
- Apply the vendor-provided patch for JBoss EAP once available to address the JDKBridge unmarshalling logic.
- Restrict network access to port 3528 to trusted management or internal segments only to prevent unauthorized access to the ORB interface.
Immediate actions
Identify and inventory all JBoss EAP instances configured with the -secmgr flag.
Threat Hunt
Monitor for anomalous outbound network connections originating from JBoss EAP JVM processes.
Data: Network connection logs (NetFlow or firewall logs), Endpoint process-to-destination mapping
Mitigations
Disable the -secmgr configuration if not strictly required for business function.
CVE-2026-84725