Loading story…
Researchers from Novee disclosed 12 vulnerabilities across four enterprise Java platforms, highlighting two pre-authentication remote code execution chains that affected Bonita BPM 10.4.3 and Apache OFBiz 24.09.05. The findings were presented at Black Hat USA 2026, with Bonita’s chain showing that a single unauthenticated POST request could bypass routing, authentication, and CSRF protections to reach an internal API that deserialized attacker-controlled XML through XStream, resulting in code execution. Novee said the broader audit also uncovered four pre-login flaws and a sandbox escape, but identified Bonita and OFBiz as the most severe cases.
In Apache OFBiz, researchers found that a default signing key exposed in the public source repository allowed attackers to forge JWT-based SSO tokens, impersonate an administrator, and then abuse callback token handling plus Groovy expression evaluation in the widget engine to achieve unauthenticated RCE. The issue, tracked as CVE-2026-31986 and rated Critical, reportedly required SSO to be enabled and could be triggered with only two GET requests. Both vendors released fixes within a standard 90-day disclosure window, while researchers urged organizations to apply updates, replace shared signing keys, normalize paths in authentication and CSRF filters, protect all dispatcher paths, and restrict deserialization and template evaluation features.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
At Black Hat USA 2026, Novee researchers publicly presented findings on 12 vulnerabilities across enterprise Java platforms, highlighting the most serious pre-authentication RCE chains in Bonita BPM and Apache OFBiz. The presentation detailed how Bonita BPM 10.4.3 and Apache OFBiz 24.09.05 could be exploited before authentication.
Both Bonita and Apache OFBiz released fixes for the reported issues during the 90-day disclosure period before the research was made public. The fixes addressed the vulnerability chains disclosed by Novee.
The Apache OFBiz pre-authentication RCE chain affecting version 24.09.05 was assigned CVE-2026-31986 and rated Critical. The chain relied on a default signing key that enabled forged tokens and abuse of Groovy evaluation in widget rendering.
Novee reported 12 vulnerabilities across four enterprise Java platforms to the affected projects before publication under a coordinated disclosure process. The sources state Bonita and Apache OFBiz released fixes within a standard 90-day disclosure window.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed critical pre-authentication remote code execution flaws in **ForgeRock/OpenAM** that let attackers execute code without logging in by abusing unsafe Java deserialization in request parameters. PortSwigger reported `CVE-2021-35464` in ForgeRock OpenAM, while later research detailed `CVE-2026-33439` in OpenIdentityPlatform OpenAM, where attacker-controlled data in the `jato.clientSession` parameter could reach `ApplicationObjectInputStream.readObject()` without class filtering. The newer flaw affected unauthenticated password-reset endpoints including `/openam/ui/PWResetUserValidation` and `/openam/ui/PWResetQuestion`, where JSP processing of `<jato:form>` tags exposed the vulnerable code path. Researchers said a crafted gadget chain could achieve code execution with a single `GET` request on OpenAM `16.0.5`, and that version `16.0.6` fixed the issue by routing `Encoder.deserialize()` through the same whitelist-based deserialization protections previously applied to `jato.pageSession`; the bug was assigned **CVSS 9.8** and mapped to `CWE-502`.
Jul 23, 2026
Researchers disclosed multiple **BMC FootPrints ITSM** vulnerabilities that can be chained to achieve **pre-authenticated remote code execution**, highlighting the product as a high-value target because ITSM platforms often contain asset inventories, incident data, configuration details, and other operationally sensitive information. *watchTowr Labs* said it found and chained flaws in 2025 against what was then a fully patched deployment, while broader reporting noted a set of four issues affecting the platform and framed the exposure as part of a wider pattern of attackers abusing enterprise management software. A related disclosure, **CVE-2025-71260**, affects BMC FootPrints versions `20.20.02` through `20.24.01.001` and stems from unsafe ASP.NET `VIEWSTATE` deserialization, allowing an authenticated attacker to execute arbitrary code and fully compromise the application. The vendor has issued hotfixes for affected releases, but the references do not all describe the exact same exploit chain: the watchTowr research focuses on **pre-auth RCE chains**, while the CVE entry covers a specific **authenticated** deserialization bug, making it adjacent but not fully the same incident thread.
Jun 29, 2026
Red Hat issued Important-security updates across JBoss BPM Suite, JBoss BRMS, JBoss Fuse Service Works, and JBoss Data Grid, addressing flaws that could lead to remote or authenticated arbitrary Java code execution. Affected components included Xalan-Java XSLT secure-processing bypasses, insecure XStream XML deserialization, Apache Camel XSLT handling, and MVEL/JBoss Rules expression evaluation; several releases also corrected XML external entity (XXE) weaknesses in OpenSAML, Camel, and RESTEasy. The updates additionally fixed Java Security Manager policy failures that could grant deployed applications `java.security.AllPermission`, JBoss MSC service-registry access-control issues, HawtJNI temporary-file risks, plaintext authentication-parameter logging, Smack XMPP spoofing, WebSocket memory-exhaustion denial of service, and TLS CBC padding-oracle exposure. Red Hat instructed customers to back up installations, stop the JBoss Application Server, apply the applicable upgraded release or roll-up patch, and restart services; organizations using rule-authoring or externally exposed environments were advised to retain Java Security Manager sandboxing for MVEL evaluation.
Aug 31, 2026