CVE-2026-8400

A flaw was found in the ORB (Object Request Broker) component of IBM SDK, Java Technology Edition. A malicious IIOP (Internet Inter-ORB Protocol) server could exploit this vulnerability to force the loading and creation of unauthorized software components. This could lead to the execution of arbitrary code, potentially compromising the affected system.

This vulnerability has been rated as Important rather than Critical because successful exploitation requires a client application to initiate a connection to an untrusted or rogue remote endpoint. In Red Hat Enterprise Linux 8, this issue affects systems running the IBM Java SDK (java-1.8.0-ibm) that use the Object Request Broker for remote communications. If a client connects to a compromised server using the Internet Inter-ORB Protocol, the server can trigger instantiation of arbitrary classes on the host, leading to unauthorized code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that applications are configured to only connect to trusted IIOP servers. Restrict network access to prevent connections to untrusted or external IIOP endpoints.