All verified exploits

CVE-2026-33439 Pre-Auth RCE via jato.clientSession Deserialization

CVE-2026-33439 is a critical-severity vulnerability. AttackerView checks OpenAM sites for it with a live exploit check.

Deterministic critical OpenAM Added cve-verified-cve-2026-33439

Is my site vulnerable to CVE-2026-33439?

Detects OpenIdentityPlatform OpenAM instances before 16.0.6 vulnerable to pre-authentication remote code execution. The jato.clientSession HTTP parameter is deserialized using raw ObjectInputStream without class filtering — a bypass of the CVE-2021-35464 fix that only protected jato.pageSession. Any unauthenticated attacker can execute arbitrary commands.

Is your app exploitable through CVE-2026-33439?

Scan your domain free