CVE-2026-105115 – OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface

Vulnerability Description:
CVE-2026-105115 describes a critical deserialization vulnerability affecting the EnterpriseConnectKit (ECK) library, specifically within its RMI (Remote Method Invocation) and JMX (Java Management Extensions) communication modules. This vulnerability is present in ECK versions 3.x and earlier. An unauthenticated, remote attacker can exploit this flaw by sending specially crafted serialized Java objects to an exposed ECK RMI or JMX endpoint. If the application using the ECK library attempts to deserialize these untrusted objects, it can lead to arbitrary code execution in the context of the vulnerable application, potentially resulting in full system compromise. The vulnerability stems from the ECK library's failure to adequately validate or restrict the classes that can be deserialized from untrusted input streams.

1. IMMEDIATE ACTIONS

1.1. Network Isolation and Access Restriction
Immediately identify and isolate all systems running applications that utilize the EnterpriseConnectKit (ECK) library, particularly those exposing RMI or JMX endpoints. Restrict network access to these endpoints to only trusted internal IP addresses or subnets. Implement temporary firewall rules to block inbound connections to common RMI (default port 1099, or other configured ports) and JMX (typically a range of dynamic ports, or specific configured ports) ports from untrusted networks.

1.2. Service Review and Disablement
Conduct an urgent inventory of all applications and services that depend on the ECK library. For non-critical services, consider temporarily disabling the RMI or JMX communication modules within the ECK configuration, or stopping the entire application service, until a permanent fix can be applied. Ensure that any administrative interfaces exposed via ECK are also restricted or disabled.

1.3. Vulnerability Scope Assessment
Utilize dependency scanning tools (e.g., Maven Dependency Plugin, Gradle dependencies, or commercial SCA tools) to identify all projects and deployments that include the ECK library. Prioritize remediation efforts based on the criticality of the affected systems and their exposure to untrusted networks.

1.4. Backup Critical Data
Before implementing any changes, ensure that recent, verified backups of all critical data and system configurations are available for affected systems.

2. PATCH AND UPDATE INFORMATION

2.1. Await Official Patch Release
Monitor official channels from the EnterpriseConnectKit vendor for the release of security patches or updated versions. It is anticipated that a patch will be released as ECK version 4.0.0 or a specific security-fix release within the 3.x branch (e.g., 3.x.1).

2.2. Upgrade to Secure Version
Once available, plan and execute an upgrade of the ECK library to the vendor-recommended secure version (e.g., ECK 4.0.0 or later). This upgrade should replace the vulnerable ECK JAR files within all affected applications.

2.3. Thorough Testing
Before deploying patches or upgrades to production environments, thoroughly test the updated applications in a staging environment to ensure full functionality and compatibility. Pay particular attention to RMI/JMX communication paths and any integrations that rely on ECK.

2.4. Verify Patch Application
After applying the patch, verify that the vulnerable ECK library files have been successfully replaced and that the application is running with the secure version. This can be done by inspecting the application's classpath, JAR file versions, or by using dependency analysis tools.

3. MITIGATION STRATEGIES

3.1. Network-Level Controls
Implement strict network segmentation and firewall rules. Limit inbound access to RMI and JMX ports to only authorized internal hosts and specific management subnets. Avoid exposing these services directly to the internet or untrusted internal networks. Utilize VPNs for remote administration access.

3.2. Deserialization Allow-listing
If the ECK library or the underlying Java environment allows, implement a deserialization allow-list (or "white-list"). This involves configuring the JVM or the ECK library to explicitly permit only a predefined set of safe classes to be deserialized, rejecting all others. This is a powerful mitigation against deserialization attacks. Consult ECK documentation for specific configuration options, or utilize JVM-level mechanisms like JEP 290 (Deserialization Filtering) if applicable to your Java version.

3.3. JVM Security Manager
Configure and enable a Java Security Manager with a restrictive security policy. The policy should limit the permissions granted to applications using the ECK library, particularly regarding file system access, network connections, and process execution. While not a direct fix for the deserialization vulnerability, it can significantly reduce the impact of successful RCE exploitation by restricting what the attacker's arbitrary code can do.

3.4. Remove Unnecessary Components
Review ECK configurations and disable or remove any RMI or JMX services that are not strictly required for application functionality. Minimizing the attack surface reduces the opportunities for exploitation.

3.5. Least Privilege for ECK Services
Ensure that the application server process running the ECK library operates with