Answer in brief
CVE-2026-46495 records a Critical severity (CVSS 9.2) vulnerability in OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI. The current sources do not mark it as known exploited. The current feed maps OpenIdentityPlatform/OpenDJ (generic), org.openidentityplatform.opendj/opendj-server-legacy (generic), org.openidentityplatform.opendj:opendj-server-legacy (maven). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps OpenIdentityPlatform/OpenDJ (generic), org.openidentityplatform.opendj/opendj-server-legacy (generic), org.openidentityplatform.opendj:opendj-server-legacy (maven). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| OpenIdentityPlatform/OpenDJgeneric | <5.1.1 | 5.1.1 |
| org.openidentityplatform.opendj/opendj-server-legacygeneric | <5.1.1 | 5.1.1 |
| org.openidentityplatform.opendj:opendj-server-legacymaven | <=5.1.0 | 5.1.1 |
Published upstream
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 22, 2026
OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiConnector.java processes attacker-controlled credential objects before authentication without a restrictive jmx.remote.rmi.server.credentials.filter.pattern, and RmiAuthenticator.authenticate in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiAuthenticator.java accepts an unconstrained Object array rather than a two-element String[]. When the JMX Connection Handler is enabled and its TCP listener is reachable, an unauthenticated remote attacker can submit a crafted serialized Java object and achieve code execution in the OpenDJ server process. The handler is disabled by default, and successful exploitation depends on the runtime classpath and Java version; remote code execution was demonstrated against OpenDJ 4.4.15 on JDK 11 with Jackson 2.12.6.1. This issue is fixed in 5.1.1.
Quoted source text, attributed separately from HOL analysis.