# CVE-2026-33439: OpenAM - RCE

> Live exploitation tracking for CVE-2026-33439 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-33439

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.3
- **Public exploit available:** Yes
- **Affected products:** OpenIdentityPlatform OpenAM
- **Weaknesses:** CWE-502 (Deserialization of Untrusted Data)
- **Tags:** enterprise_software, web_application

## Description

Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains <jato:form> tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6.

## CrowdSec analysis

[CVE-2026-33439](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-33439) is a critical pre-authentication remote code execution vulnerability in OpenIdentityPlatform OpenAM prior to version 16.0.6. By exploiting unsafe Java deserialization in the jato.clientSession HTTP parameter, unauthenticated attackers can execute arbitrary commands on the server, bypassing previous mitigations. This flaw can be leveraged to fully compromise affected OpenAM servers, making it a significant risk for organizations using vulnerable versions.

CrowdSec has been tracking this vulnerability and its exploits since 6th of May 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-33439 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit endpoints such as `/openam/ui/PWResetUserValidation` by sending malicious serialized data in the `jato.clientSession` parameter, enabling unauthenticated remote code execution via unsafe Java deserialization.

## Timeline

- 2026-04-07: CVE Published. CVE-2026-33439 is published to NVD.
- 2026-05-06: Rule Released. CrowdSec releases a rule to detect CVE-2026-33439 exploitation attempts against the CrowdSec Network.
- 2026-05-22: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-33439 for the first time.

## References

- https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qj
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33439.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-33439) follows observed exploitation activity for CVE-2026-33439. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.