External risk intelligence

OpenAM Remote Code Execution via Unsafe Deserialization

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-62379

The vulnerability exists in an access management and authentication service endpoint that is exposed by default without authentication. As an identity and access management solution, this product is designed to be public-facing to handle authentication requests, making the vulnerable endpoint directly reachable over the internet in standard deployments.

Code Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Open Access Management (OpenAM) software, an access management solution. The flaw allows unauthenticated attackers to execute arbitrary code on the server, potentially leading to a compromise of the system. The main concern is confirming relevance and exposure within our environment.

Unauthenticated code execution in access management software.
Affects systems handling user authentication and access.
Confirm relevance and exposure; it's a critical vulnerability.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can initiate a connection to the OpenAM server and send a specially crafted XML request to the `/authservice` endpoint. This request can trick the server into loading and running arbitrary Java code, potentially leading to the execution of further malicious commands on the server.

Unauthenticated network access required.
Vulnerable XML parsing and class loading.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

In default configurations, an unauthenticated attacker could trigger arbitrary Java class initialization and unsafe deserialization through a specific XML element when processing authentication requests. This could lead to the execution of malicious code within the server process.

Server process code execution.
Unauthenticated network requests.
Compromised authentication services.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts OpenAM, an access management solution, and is likely the responsibility of the platform or infrastructure teams managing the OpenAM deployment, in coordination with security teams. The first practical step is to identify all instances of the affected technology, confirm their reachability and business criticality, and then engage with the accountable owners to plan remediation based on the assessed risk.

Platform and security teams own the issue.
Verify affected instances and reachability first.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Open Access Management (OpenAM) used for?

OpenAM is a software solution designed to manage digital identities, authentication, and access control for applications and services. It acts as a central authority that validates user credentials and grants permissions, making it a critical component for controlling who or what can access protected systems within an organization's technology environment.

What does CVE-2026-62379 mean for system security?

This vulnerability involves Improper Control of Generation of Code and Use of Dynamically-Controlled Input. Essentially, the software fails to properly vet specific instructions provided in an incoming request, allowing an attacker to force the server to load and run unauthorized Java code. This weakness grants an attacker the ability to execute commands with the same privileges as the OpenAM service itself.

How can an attacker trigger this vulnerability?

An attacker triggers the flaw by sending a specially crafted XML request to the /authservice endpoint. Because the system performs this dangerous action before checking user identity, no login is required to start the attack. Note that enabling the sunRemoteAuthSecurityEnabled setting does not stop this process, as the underlying security check happens too late to block the initial unauthorized code loading.

Why should I care about this vulnerability based on Halo Surface Signal?

Halo Surface Signal indicates a high likelihood of risk because OpenAM is, by design, an authentication service intended to be accessible to users. Since the vulnerable endpoint is exposed by default without authentication, it is often directly reachable over the internet in standard deployments, making it a clear target for remote attackers.

What are the first steps to handle this vulnerability?

The primary step is to locate all instances of OpenAM within your infrastructure and determine if they are reachable from the network. Once you have identified these systems, collaborate with your platform or security teams to prioritize the rollout of the official 16.1.2 update, which addresses the flaw by properly managing class loading and authentication checks.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.