Critical Vulnerabilities Patched in OpenAM with Release of Version 16.1.2
OpenAM has been found to contain multiple vulnerabilities, some of which allow remote code execution. The development team addressed these issues by releasing security update OpenAM 16.1.2 on July 20, 2026, covering 18 vulnerabilities in total, including those inherited from third-party dependencies.
The flaw tracked as CVE-2026-62379 affects the authentication endpoint. It permits loading and instantiating arbitrary Java classes specified in XML without any validation, enabling unauthenticated attackers to execute code on the server. Another critical issue, CVE-2026-62263, arises from insufficient restrictions on deserialized objects during authentication, again allowing unauthenticated remote code execution.
GitHub assigned CVE-2026-62379 a CVSS v3.1 base score of 9.8, while CVE-2026-62263 received a CVSS v4.0 score of 9.2; both are rated Critical. The update additionally fixes cross-site scripting vulnerability CVE-2026-62280 on the authorization consent page and resolves issues in dependent software including the Node.js component, js-yaml, and websocket-driver.
Full list of addressed CVEs
- CVE-2026-45736
- CVE-2026-48779
- CVE-2026-49982
- CVE-2026-53550
- CVE-2026-54466
- CVE-2026-54490
- CVE-2026-61787
- CVE-2026-62261
- CVE-2026-62263
- CVE-2026-62280
- CVE-2026-62379
- CVE-2026-63463
- CVE-2026-63467
- CVE-2026-63468
- CVE-2026-63484
- CVE-2026-63485
- CVE-2026-63487
- CVE-2026-63488
Related articles
What Is an Exploit: How a Flaw in Someone Else's Code Becomes Unauthorized Access to Your Server
The article explains the critical distinction between a vulnerability and an exploit using the Log4Shell incident as the primary example. It breaks down how Log4j's JNDI lookup flaw allowed remote code execution simply by logging a crafted string, leading to CVE-2021-44228 with a maximum CVSS score. The piece covers the full lifecycle from vulnerability discovery to payload delivery, including memory corruption, injection flaws, and logical errors. It details defensive mechanisms such as stack canaries, DEP, ASLR, and CFG, along with attacker responses like ROP chains. Real-world cases including Zerologon, Heartbleed, Stuxnet, and WannaCry illustrate the progression from single bugs to multi-stage exploit chains. The text also addresses zero-day economics, exploit kits, bug bounty programs, and practical mitigation strategies centered on KEV catalogs and EPSS scoring.
AMD Memory Controller PoC Bypasses Hardware Isolation on Family 16h Processors
Security researcher Christopher Domas released a proof-of-concept project named skitter-creek-bath-salts that demonstrates a bypass of hardware memory protections on AMD Family 16h processors. The technique manipulates DRAM controller settings to access regions that should remain inaccessible even to the operating system, kernel, and ring-0 code. By altering a single register after upstream protections have acted, the controller remaps addresses, creating an alias that leads to the same DRAM cells through an alternative path. The PoC uses linear algebra and the Z3 SMT solver to locate alias addresses and carefully manages interrupts, cache, and page tables to avoid system crashes during the brief remapping window. Demonstrations include potential access to the AMD Platform Security Processor, fTPM data, System Management Mode regions, C6 processor states, and microcode storage, with the possibility of modifying microcode patches. The research was validated only on AMD Family 16h; no similar issues have been reported for newer AMD, Intel, ARM, or RISC-V platforms.
Critical GeoServer Vulnerability CVE-2024-36401 Actively Exploited for Unauthenticated Remote Code Execution
The CVE-2024-36401 flaw in GeoServer and its GeoTools library allows attackers to achieve remote code execution without authentication by abusing property name expressions interpreted as XPath. Active exploitation has already led to confirmed intrusions involving initial access, lateral movement, and persistence with tools such as China Chopper web shells. Multiple OGC endpoints including WFS GetFeature, WMS GetMap, and WPS Execute are affected when exposed to the internet. Patches are available in GeoServer versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2. Organizations unable to patch immediately can mitigate risk by removing the gt-complex JAR file, though this may break functionality. Additional defenses include restricting internet exposure through IP allowlisting, VPNs, and reverse proxies while monitoring logs for anomalous requests. Any previously exposed instances should be treated as potentially compromised, with full incident response including credential rotation and host forensics recommended.
Critical GeoServer Vulnerability CVE-2024-36401 Actively Exploited for Unauthenticated Remote Code Execution
The vulnerability CVE-2024-36401 in GeoServer is already being exploited in real-world attacks and enables remote code execution without authentication. The flaw stems from how GeoServer and its GeoTools library interpret certain property names, allowing malicious XPath expressions via commons-jxpath in default configurations. Attackers can abuse multiple OGC endpoints including WFS GetFeature and GetPropertyValue, WMS GetMap, GetFeatureInfo and GetLegendGraphic, plus WPS Execute to gain initial access. Observed intrusions follow a familiar pattern of reconnaissance, lateral movement and persistence with web shells such as China Chopper. Patches are available in GeoServer 2.22.6, 2.23.6, 2.24.4 and 2.25.2, while a temporary mitigation involves removing the gt-complex jar file. Organizations are urged to apply updates immediately, restrict internet exposure and hunt for indicators of compromise in logs and on hosts.