Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2021-11-17. Apply updates per vendor instructions.
Priority
LOW
Exploitation
ACTIVE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-33439 OpenAM pre-auth RCE , CVE-2021-35464 deserialization bypass for newer JDKs with command echo. https://t.co/ahqPtr2C69
Post summary
The tweet reports two CVEs—CVE-2026-33439 in OpenAM as a pre-authentication remote code execution vulnerability, and CVE-2021‑35464 as a deserialization bypass involving command echo—without evidence of active exploitation or mitigation information.
🚨 CVE-2026-33439: Pre-Authentication Remote Code E... OpenAM's jato.clientSession parameter bypasses CVE-2021-35464 whitelist fix—pre-auth RCE via Java deserialization on an... https://zerodaysignal.com/vulnerability/CVE-2026-33439 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
CVE‑2026‑33439 is a pre‑authentication remote code execution flaw in OpenAM, enabled by a Java deserialization bypass that defeats a whitelist fix. The linked article likely contains further details and potentially a PoC.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | forgerock | access_management | - | - | - |
| App | forgerock | openam | - | - | - |