Loading...
Skip to main content
GeekWala

CVE-2026-46495 — Vulnerability in...

CRITICAL

OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI

Published June 22, 2026Updated June 22, 2026Source: osv

Summary

## Summary **Description** A Deserialization of Untrusted Data (CWE-502) issue in OpenDJ's JMX RMI connector allows an unauthenticated remote attacker to deserialize arbitrary Java objects on the server. The vulnerability exists because the platform reads and processes attacker-controlled bytes prior to authentication. This affects OpenDJ Community Edition through 5.1.0. This has been patched in version 5.1.1. ## Impact This impacts all current OpenDJ releases where the JMX Connection Handler is enabled. While disabled by default, it is frequently enabled in practice for monitoring integrations. Exploitation requires TCP reachability to the configured listener and does not require authentication, prior privileges, or client certificates. Successful exploitation results in unauthenticated Remote Code Execution (RCE), with the severity depending on the runtime classpath and Java version. Unauthenticated RCE was demonstrated on the OpenDJ 4.4.15 (JDK 11 + Jackson 2.12.6.1). ## Patch This has been patched in OpenDJ Community Edition version 5.1.1. Users are encouraged to update to the latest release.

Advisory Timeline

  • First published June 22, 2026 (112 days ago).
  • Last revised June 22, 2026 — 0 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven
Update org.openidentityplatform.opendj:opendj-server-legacy to 5.1.1 or later
<!-- Update pom.xml dependency version to 5.1.1 for org.openidentityplatform.opendj:opendj-server-legacy -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: maven (1).

PackageEcosystemAffectedFixed In
org.openidentityplatform.opendj:opendj-server-legacy
maven
4.10.0, 4.10.1, 4.10.2, 4.4.10 (+37 more)5.1.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-502
    Deserialization of Untrusted DataMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.3 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2026-46495?
OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.3/10).
How do I check if my project is affected by CVE-2026-46495?
CVE-2026-46495 affects org.openidentityplatform.opendj:opendj-server-legacy. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-46495 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.3

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-43x2-g84q-fmqx

Related CVEs

More Maven advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies