Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-04T00:00:00 java-1.8.0-ibm: Arbitrary class loading and instantiation via malicious IIOP server 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-470

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes.

A flaw was found in the ORB (Object Request Broker) component of IBM SDK, Java Technology Edition. A malicious IIOP (Internet Inter-ORB Protocol) server could exploit this vulnerability to force the loading and creation of unauthorized software components. This could lead to the execution of arbitrary code, potentially compromising the affected system.

To mitigate this issue, ensure that applications are configured to only connect to trusted IIOP servers. Restrict network access to prevent connections to untrusted or external IIOP endpoints. Red Hat Enterprise Linux 8 2026-08-10T00:00:00Z RHSA-2026:52949 java-1.8.0-ibm-1:1.8.0.8.70-1.el8_10 https://www.cve.org/CVERecord?id=CVE-2026-8400 https://nvd.nist.gov/vuln/detail/CVE-2026-8400 https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities#IBM_Security_Update_July_2026 https://www.ibm.com/support/pages/node/7282446