CVE-2026-33439
Pre-Authentication Remote Code Execution via jato.clientSession Deserialization in OpenAM
- Published
- Apr 7, 2026
- Updated
- Apr 8, 2026
- Assigning CNA
- GitHub_M
- Evidence observed
- Aug 25, 2026
Primary CVSS
nvd · CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XLow · next 30 days
- Percentile
- 94.9%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains <jato:form> tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6.
Sources
http/cves/2026/CVE-2026-33439.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: dsl($.matchers[*].type)
- oob: interactsh_reference($.template_text)
- CVE-2026-33439-PoCExploit
Exploit for OpenAM pre-auth RCE (CVE-2026-33439) using a Java deserialization gadget chain to execute commands and return output directly in the HTTP response.
- CVE-2026-33439-OpenAMResearch
Vulnerable endpoint description for CVE-2026-33439 in OpenAM
- CVE-2026-33439Exploit
First publicly shared exploit implementation for CVE-2026-33439 (OpenAM pre-auth RCE via jato.clientSession deserialization).
Python PoC for CVE-2026-33439, an OpenAM pre-authentication RCE via jato.clientSession deserialization
Python PoC exploiting CVE-2026-33439, a pre-auth RCE in OpenAM via Java deserialization of the jato.clientSession parameter, with interactive and blind shell modes.
Proof of concept for CVE-2026-33439, an unauthenticated RCE in OpenAM via Java deserialization
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.