CVE-2026-33439

OpenIdentityPlatform OpenAM versions prior to 16.0.6 contain a critical pre-authentication remote code execution vulnerability stemming from unsafe Java deserialization of the jato.clientSession HTTP parameter. This flaw bypasses previous security mitigations applied to related parameters following CVE-2021-35464, allowing unauthenticated attackers to execute arbitrary commands on affected servers. The vulnerability presents a severe risk profile with a CVSS score of 9.8 (Critical), requiring no authentication, low attack complexity, and no user interaction. An attacker can exploit this vulnerability by sending a malicious serialized Java object to any JATO ViewBean endpoint containing form tags, such as password reset pages, resulting in complete system compromise including confidentiality, integrity, and availability breaches. As of the available data, this vulnerability does not appear to be actively exploited in the wild, with no confirmed presence in the Known Exploited Vulnerabilities (KEV) catalog and minimal community attention indicators. However, given the critical severity rating, ease of exploitation, and network accessibility of typical OpenAM deployments, organizations running affected versions should prioritize immediate patching to version 16.0.6 without awaiting evidence of active exploitation.