Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap

Summary

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

Remediation

1. Inventory every Red Hat Red Hat JBoss Enterprise Application Platform 7 deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://access.redhat.com/security/cve/CVE-2026-84725
• Referencehttps://bugzilla.redhat.com/show_bug.cgi?id=2527228