NVD HIGH: CVE-2026-105115 — OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation v...

Saturday, October 3, 2026 at 02:16 PM UTC·Source: NIST NVD

Updated: Saturday, October 3, 2026 at 05:00 PM UTC

Executive Summary

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/* with an unverified session identifier and a chosen class name, crashing the server, probing the classpath, or potentially reaching code execution via gadge

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-105115

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Oct 3, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

ANZ completes cross-border tokenised deposit payment with Swift ledger

Australia's ANZ has carried out a live corporate treasury transactions using tokenised deposits and Swift’s blockchain ledger.

2h agoFinextra

MEDIUMVulnerability

Anchorage Digital expands global services with Standard Chartered

Digital asset custody services provider Anchorage Digital has formed a partnership with Standard Chartered through which it will offer USD accounts and access to Swift wires, including transfers to and from third parties, to eligible non-US institutional clients.

2h agoFinextra

MEDIUMVulnerability

CISA to keep cyber pay incentives, but less staff will qualify

Justin Doubleday reports: The Cybersecurity and Infrastructure Security Agency is continuing to offer cyber pay incentives to retain skilled technical staff, but less employees will qualify for the program under revised criteria that ties eligibility to job series and performance ratings. The revised policy has sparked some concern that CISA could lose more staff after... Source

3h agoDataBreaches.net