CVE-2026-33439: 
Java vulnerability analysis and mitigation

CVE-2026-33439 is a pre-authentication Remote Code Execution (RCE) vulnerability in OpenIdentityPlatform OpenAM caused by unsafe Java deserialization of the jato.clientSession HTTP parameter. It affects OpenAM versions 16.0.5 and earlier (all versions with ClientSession.deserializeAttributes() unpatched), and was disclosed on April 7, 2026 via a GitHub Security Advisory. The vulnerability bypasses the WhitelistObjectInputStream mitigation introduced after CVE-2021-35464, which only protected the jato.pageSession parameter. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (Github Advisory, OpenAM Advisory).

The root cause (CWE-502: Deserialization of Untrusted Data) lies in ClientSession.deserializeAttributes(), which calls Encoder.deserialize() → ApplicationObjectInputStream.readObject() with no class whitelist, unlike the patched jato.pageSession path. The jato.clientSession parameter value is read directly from the HTTP request and deserialization is triggered during JSP rendering when <jato:form> tags invoke getClientSession() → hasAttributes() → ensureAttributes() → deserializeAttributes(). The exploit leverages a gadget chain using classes bundled in the OpenAM WAR: PriorityQueue.readObject() → Column$ColumnComparator.compare() → PropertyUtils.getObjectPropertyValue() → TemplatesImpl.getOutputProperties() (via xalan-2.7.3.jar) → TransletClassLoader.defineClass() → attacker-supplied bytecode → Runtime.getRuntime().exec(cmd). Public PoC repositories have been identified (e.g., github.com/shreyas-malhotra/CVE-2026-33439-OpenAM and github.com/Ibonok/CVE-2026-33439-PoC) (OpenAM Advisory, Github Advisory).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary OS commands as the application server user, resulting in full server compromise with high confidentiality, integrity, and availability impact. An attacker can exfiltrate sensitive identity and authentication data managed by OpenAM, deploy persistent backdoors, and use the compromised server as a pivot point for lateral movement within the network. Any OpenAM deployment exposing at least one JATO ViewBean endpoint with <jato:form> tags (such as Password Reset pages) is affected, regardless of authentication state (OpenAM Advisory, Github Advisory).

Multiple public PoC repositories appeared within weeks of disclosure (e.g., github.com/shreyas-malhotra/CVE-2026-33439-OpenAM and github.com/Ibonok/CVE-2026-33439-PoC), and Nuclei detection templates were added to ProjectDiscovery's template library. Emerging Threats updated its ruleset (v11190, May 11, 2026) to include detection for this vulnerability. The EPSS score is approximately 13.4% (94th percentile), indicating elevated exploitation probability. No confirmed in-the-wild exploitation or CISA KEV listing has been reported as of the latest data, and no specific threat actor attribution is available (Github Advisory, Emerging Threats).

1. Reconnaissance: Identify internet-facing OpenAM instances (version ≤16.0.5) using Shodan, Censys, or similar tools. Confirm accessible JATO ViewBean endpoints whose JSPs render <jato:form> tags, such as the Password Reset pages (e.g., /openam/ui/PWResetUserValidation).
2. Craft malicious serialized payload: Using a Java deserialization gadget chain tool (e.g., ysoserial or a custom chain), construct a serialized Java object exploiting the PriorityQueue → Column$ColumnComparator → TemplatesImpl chain. Embed attacker-controlled bytecode (e.g., a reverse shell command) in the TemplatesImpl._bytecodes field.
3. Encode the payload: Encode the serialized object using OpenAM's HTTP64 encoding scheme (Base64 variant used by Encoder.decodeHttp64()) to produce a value suitable for the jato.clientSession parameter.
4. Send the crafted request: Submit a GET or POST HTTP request to any accessible JATO ViewBean endpoint with the encoded payload as the jato.clientSession parameter value (e.g., GET /openam/ui/PWResetUserValidation?jato.clientSession=<encoded_payload>).
5. Trigger deserialization: The server-side JSP rendering invokes getClientSession() → deserializeAttributes(), which calls Encoder.deserialize() → ApplicationObjectInputStream.readObject() with no class filtering, executing the gadget chain.
6. Achieve code execution: The gadget chain loads attacker bytecode via TransletClassLoader.defineClass(), instantiates the malicious class, and executes the embedded OS command (e.g., a reverse shell) as the application server user (OpenAM Advisory).

• Network: Unusual HTTP GET or POST requests to JATO ViewBean endpoints (e.g., /openam/ui/PWResetUserValidation, /openam/module/PasswordReset) containing a jato.clientSession parameter with a long, Base64-like encoded value; outbound connections from the OpenAM/Tomcat process to unknown external IPs (potential reverse shell).
• Logs: Application server access logs showing requests to Password Reset or other JATO endpoints with abnormally large jato.clientSession parameter values; Java deserialization errors or stack traces in Tomcat/OpenAM logs referencing ClientSession, Encoder, or ApplicationObjectInputStream; amConsole debug log entries showing unexpected Encoder:deserialize callers trace messages (added in the patch).
• Process: Unexpected child processes spawned by the Tomcat/Java process (e.g., /bin/bash, cmd.exe, curl, wget, python, nc); new network listeners or connections initiated by the Java process.
• File System: Unexpected web shells, scripts, or JAR files written to the OpenAM or Tomcat deployment directories; new cron jobs or scheduled tasks created by the application server user account.
• Network Signatures: Emerging Threats ruleset v11190 (released May 11, 2026) includes IDS/IPS signatures for this vulnerability (Emerging Threats).

Upgrade OpenAM to version 16.0.6 or later, which applies WhitelistObjectInputStream filtering to ClientSession.deserializeAttributes() (via IOUtils.deserialise()) matching the mitigation already in place for jato.pageSession (OpenAM Release, Patch Commit). As interim mitigations: apply network-level access controls to restrict exposure of OpenAM endpoints (especially Password Reset pages) to trusted networks only; consider adding a JVM-wide JEP 290 deserialization filter as defense-in-depth; and audit all callers of Encoder.deserialize() for user-controlled input. Deploy Emerging Threats ruleset v11190 or later for IDS/IPS detection coverage (Github Advisory).

The Belgian Centre for Cybersecurity (CCB) issued a warning advisory noting that the vulnerability can be exploited to fully compromise OpenAM servers (CCB Advisory). The vulnerability was covered by SecurityOnline.info and The Hacker News' weekly recap (May 2026), highlighting it alongside other notable vulnerabilities. ProjectDiscovery added Nuclei detection templates for this CVE and featured it in their April 2026 Nuclei Templates blog post. Social media activity on Bluesky noted the availability of PoC code, increasing community awareness of exploitation risk (SecurityOnline, The Hacker News).