External risk intelligence

OpenAM Unsafe Java Deserialization RCE Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-33439

OpenAM is an access management and identity solution typically deployed as a public-facing gateway or identity portal to facilitate user authentication and access control. Because it is designed to handle external authentication requests, it is inherently exposed to the internet in common deployments.

Deserialization

Openidentityplatform Openam

before 16.0.6

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical remote code execution vulnerability in OpenAM, an access management solution. The flaw, stemming from unsafe Java deserialization, allows unauthenticated attackers to execute arbitrary commands on the server, potentially leading to a complete system compromise. The main concern is confirming whether this specific technology is in use and exposed.

Unauthenticated attackers can run commands.
Critical access management vulnerability.
Confirm usage and exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can execute arbitrary commands on the server by exploiting a pre-authentication remote code execution vulnerability in OpenAM. This is achieved by sending a specially crafted serialized Java object within the `jato.clientSession` HTTP parameter to a JATO ViewBean endpoint that uses a `<jato:form>` tag, bypassing a previous security mitigation.

No prior authentication required.
Triggered via `jato.clientSession` parameter.
Arbitrary command execution on server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in OpenAM could allow an unauthenticated attacker to execute arbitrary commands on the server. This is possible when specific JSP pages containing `<jato:form>` tags are accessed, and the attacker sends a specially crafted serialized Java object through the `jato.clientSession` parameter, bypassing previous security measures.

Server-side code execution.
Via crafted HTTP requests.
System compromise and data theft.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability affects OpenAM, an access management solution. Teams responsible for identity and access management, application security, and infrastructure hosting OpenAM should act. The immediate priority is to identify all instances of OpenAM, confirm their exposure and business criticality, and then plan remediation based on risk, potentially involving coordination with the vendor for updates.

Identify, assess, and own the risk.
Verify all OpenAM deployment locations.
Plan and execute the upgrade.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenIdentityPlatform OpenAM?

OpenAM is an access management and identity solution used to handle user authentication and control access to applications. It often serves as a centralized gateway, managing identity lifecycles and secure logins for both internal services and external web portals.

What does unsafe Java deserialization mean for CVE-2026-33439?

This vulnerability, classified as CWE-502 (Deserialization of Untrusted Data), occurs when the software takes complex data from an untrusted source and reconstructs it into a Java object without adequate validation. In CVE-2026-33439, an attacker provides a malicious serialized object that, when processed by the server, allows them to execute arbitrary commands.

How is this OpenAM vulnerability triggered?

An attacker triggers this by sending a crafted serialized Java object in the 'jato.clientSession' parameter to a JATO ViewBean endpoint. The target page must contain '<jato:form>' tags, such as a password reset page. Importantly, pages lacking these specific tags are not susceptible to this specific exploit path, as the execution relies on that underlying form-handling mechanism.

Is my deployment at risk according to Halo Surface Signal?

Halo Surface Signal indicates a high likelihood of risk because OpenAM is typically deployed as a public-facing identity portal. Since it is designed to accept incoming authentication requests from the internet, these instances are often inherently exposed. If your OpenAM instance is reachable from the internet, it should be prioritized for assessment.

How do I fix the vulnerability in my OpenAM environment?

The primary resolution is to upgrade your OpenAM software to version 16.0.6 or later, which addresses this deserialization flaw. Before applying updates, identify all instances of OpenAM running in your infrastructure, verify their specific version numbers, and plan your upgrade path to ensure compatibility and system stability.

References

github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.