Unrated

Authenticated RCE in OpenAM Groovy server-side scripting sandbox

IdentifiersCVE-2026-47424CWE-94

CVE-2026-47424 is an authenticated remote code execution vulnerability in OpenAM Community Edition caused by a sandbox escape in Groovy-based server-side scripting. Based on the provided advisory, a user who can create or modify server-side scripts that are executed by OpenAM can break out of the intended scripting restrictions and invoke operating-system commands from within the OpenAM JVM. The issue affects the server-side scripting mechanism rather than a client-side component, and the resulting code execution occurs in the security context of the application server administrator account running OpenAM.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows authenticated remote code execution on the OpenAM host. An attacker with the necessary scripting permissions can execute arbitrary OS commands from the OpenAM JVM as the application server admin, bypass intended realm isolation, cross realm boundaries, and potentially compromise the entire OpenAM process and every realm served by that instance.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, restrict or disable OpenAM server-side scripting features where operationally feasible, and tightly limit which authenticated users or roles can create, edit, or execute Groovy server-side scripts. Review and reduce delegated administrative permissions related to scripting, monitor for unexpected script changes and suspicious command execution from the OpenAM process, and isolate the OpenAM host and service account to reduce post-exploitation impact. Specific vendor mitigation guidance beyond patching was not provided in the supplied content.

Remediation

Patch, then assume compromise.

Upgrade OpenAM Community Edition to version 16.1.1 or later.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

OpenIdentityPlatformOpenamapplication

OpenIdentityPlatformOpenam-Scriptingapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity