CVE WatchJul 24, 2026

CVE-2026-33439

Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authenti

CVSS

9.8

Critical

EPSS

9.3%

p95

KEV

—

Exploit Today

0-100

Published: Apr 7, 2026 · Last modified: Jul 24, 2026 · CWE-502

EPSS · 30d

8.4%EPSS · 30 days9.3%

2026-09-302026-10-28

Technical description

Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains <jato:form> tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6.

Official references

github.comhttps://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qj

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-621319.8 CRI

—

———Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.3h CVE-2026-620189.8 CRI

—

———Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.3h CVE-2026-620179.8 CRI

—

———Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.3h CVE-2026-620169.8 CRI

—

———Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.3h CVE-2026-620159.8 CRI

—

———Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.3h CVE-2026-620149.8 CRI

—

———Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.3h