VulnSocial

CVE-2026-62379Patch

LOW

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

Back to dashboard
0.5/ 10 priority

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 6 mentions across 5 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 4 signals
  • Technical details provided in 6 signals
  • Disclosure: 2 classified signals
  • Peaked at 2 mentions on most recent observed day (2026-09-15)
  • 6 total mentions across 5 days

Deep dive

Activity timeline6 mentions / 5d
01122Mentions · 2026-07-25: 1Mentions · 2026-07-31: 1Mentions · 2026-08-01: 1Mentions · 2026-08-03: 1Mentions · 2026-09-15: 2Patch / Workaround · 2026-07-25: 1Patch / Workaround · 2026-07-31: 1Patch / Workaround · 2026-08-01: 1Patch / Workaround · 2026-09-15: 1Technical Details · 2026-07-25: 1Technical Details · 2026-07-31: 1Technical Details · 2026-08-01: 1Technical Details · 2026-08-03: 1Technical Details · 2026-09-15: 207-2507-3108-0108-0309-15
Signal classification2 categories
Patch
466.7%
Disclosure
233.3%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-07-251
Patch1
2026-07-311
Patch1
2026-08-011
Patch1
2026-08-031
Disclosure1
2026-09-152
Disclosure1Patch1
Full discourse6 posts
  • ThreatWire@ThreatWire_
    Patch

    🚨 OpenAM 16.1.2 patches 4 vulnerabilities, including CVE-2026-62379 (CVSS 9.8), which could allow unauthenticated RCE, and CVE-2026-62261 (CVSS 9.9). No active exploitation or public PoC has been reported. 🔗 https://github.com/OpenIdentityPlatform/OpenAM/security/advisories #OpenAM #RCE #CVE #CyberSecurity

    Post summary

    OpenAM 16.1.2 patches four high‑severity vulnerabilities, including CVE-2026-62379 and CVE-2026-62261, with no known active exploitation or publicly available PoC.

    020133948
    1.7K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    Four OpenAM vulnerabilities are fixed in 16.1.2. CVE-2026-62379 (CVSS 9.8) allows unauthenticated remote code execution; CVE-2026-62261 scores 9.9. #OpenAM #RCE #IAM #CVE202662379 http://securityonline.info/openam-cve-2026-62379/

    Post summary

    OpenAM vulnerabilities CVE-2026-62379 and CVE-2026-62261, both with high CVSS scores and remote code execution potential, were fixed in version 16.1.2 as announced.

    01052613
    13.0K followersView on X
  • VulnTracker@vuln_tracker
    Patch

    Unauthenticated RCE in OpenAM — CVSS 9.8. CVE-2026-62379 lets an attacker send a crafted CustomCallback XML element to OpenAM's pre-auth endpoint, triggering arbitrary Java class instantiation and unsafe deserialization — no login required. Enabling sunRemoteAuthSecurityEnabled won't save you; the vulnerable parsing happens before that check runs. Fixed in OpenAM 16.1.2. Update now. Details: http://vulntracker.io/cves/CVE-2026-62379 #CVE #OpenAM #RCE #InfoSec #CyberSecurity #VulnerabilityManagement #PatchNow #IAM

    Post summary

    The text announces an unauthenticated RCE vulnerability (CVE-2026-62379) in OpenAM with a CVSS score of 9.8, caused by unsafe deserialization. It highlights that the issue is fixed in OpenAM 16.1.2 and urges users to update.

    01001180
    759 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-62379 Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts a CustomCallback XML eleme… https://www.cve.org/CVERecord?id=CVE-2026-62379

    Post summary

    The text discloses CVE-2026-62379, detailing a pre-authentication vulnerability in OpenAM's /authservice PLL endpoint related to improper XML handling, but lacks explicit information on PoCs, exploits, or remediation.

    00000719
    58.1K followersView on X
  • キタきつね@foxbook
    Disclosure

    OpenAMの脆弱性CVE-2026-62379（CVSS 9.8）は認証なしのリモートコード実行を可能にし、CVE-2026-62261はCVSS 9.9のスコアを獲得した OpenAM CVE-2026-62379 (CVSS 9.8) Enables Unauthenticated Remote Code Execution, CVE-2026-62261 Scores CVSS 9.9 #DailyCyberSecurity (Jul 31) https://securityonline.info/openam-cve-2026-62379/

    Post summary

    The post announces two severe OpenAM vulnerabilities, CVE‑2026‑62379 (RCE, CVSS 9.8) and CVE‑2026‑62261 (CVSS 9.9), highlighting their critical nature and remote execution potential.

    00000298
    4.9K followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨Critical - OpenAM Unauthenticated Remote Code Execution via Unsafe Reflection (CVE-2026-62379) OpenAM's remote authentication endpoint (/authservice, PLL) accepts an XML element that names an arbitrary Java class, which the server loads and instantiates via Class.forName in AuthXMLUtils.createCustomCallback with no validation. On a default configuration this is reachable without authentication. An unauthenticated remote attacker can therefore execute code and fully compromise the server - and because OpenAM is an SSO/identity provider guarding many downstream applications, that compromise reaches the wider identity trust chain. All releases up to and including 16.1.1 are affected (the defect predates the Open Identity Platform fork). CVSS 9.8. 👉Upgrade OpenAM to 16.1.2. Interim: enable sunRemoteAuthSecurityEnabled and block external access to /authservice.

    Post summary

    The text announces a critical remote code execution flaw in OpenAM, provides technical details and a CVSS score, and offers a clear patching advice: upgrade to 16.1.2 and apply interim mitigations.

    0000066
    254 followersView on X

Explore more

Back to dashboard