{"id":"CVE-2026-105115","published":"2026-10-03T14:16:38.110","lastModified":"2026-10-06T15:18:12.170","description":"OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/* with an unverified session identifier and a chosen class name, crashing the server, probing the classpath, or potentially reaching code execution via gadget chains.","cvssScore":8.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-wxmx-q96f-w4gw","tags":[]},{"url":"https://www.vulncheck.com/advisories/openam-before-16.1.3-unauthenticated-arbitrary-class-instantiation-via-jax-rpc-interface","tags":[]}],"exploitRefs":[{"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-wxmx-q96f-w4gw","tags":[]}],"hasPoc":true,"ai":{"summary":"This vulnerability allows unauthenticated attackers to execute arbitrary code via the legacy JAX-RPC SOAP interface, potentially leading to server crashes or code execution.","exploitability":"Exploitation requires sending specific SOAP requests with a chosen class name, making it moderately difficult. Attackers need access to the legacy JAX-RPC interface.","blast_radius":"If exploited, this could lead to complete server compromise, data loss, or denial of service for the affected OpenAM instance.","remediation":"Upgrade to OpenAM 16.1.3 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","soap","unauth","code-execution"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-04T08:41:27.161Z"}}