OpenAM - RCE (CVE-2026-33439)
Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains jato:form tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6.
psychologyCrowdSec Analysis
CVE-2026-33439 is a critical pre-authentication remote code execution vulnerability in OpenIdentityPlatform OpenAM prior to version 16.0.6. By exploiting unsafe Java deserialization in the jato.clientSession HTTP parameter, unauthenticated attackers can execute arbitrary commands on the server, bypassing previous mitigations. This flaw can be leveraged to fully compromise affected OpenAM servers, making it a significant risk for organizations using vulnerable versions.
CrowdSec has been tracking this vulnerability and its exploits since 6th of May 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-33439 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit endpoints such as /openam/ui/PWResetUserValidation by sending malicious serialized data in the jato.clientSession parameter, enabling unauthenticated remote code execution via unsafe Java deserialization.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-04-07 |
| Rule Released | 2026-05-06 |
| CrowdSec First Seen | 2026-05-22 |