This vulnerability arises from the openjdk-orb's JDKBridge component honoring attacker-supplied CDR codebase URLs during object unmarshalling in Red Hat JBoss Enterprise Application Platform 7 when run with the -secmgr option. This behavior allows an unauthenticated attacker to load and instantiate arbitrary classes remotely in the server JVM prior to the enforcement of EJB security interceptors, potentially leading to unauthorized code execution. The vulnerability is tracked as CVE-2026-15560 with a CVSS v3.1 base score of 8.1 (high severity). The vendor advisory from Red Hat confirms the issue but does not currently provide explicit patch or remediation details.

Successful exploitation enables an unauthenticated attacker to execute arbitrary code in the server JVM, compromising confidentiality, integrity, and availability of the affected system. This can lead to full system compromise before EJB security mechanisms can intervene.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15560 for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor the vendor advisory for updates and consider restricting access to the affected port (3528) to trusted networks as a precautionary measure until a fix is available.