Answer in brief
CVE-2026-46495 records a Critical severity vulnerability in OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI. The current sources do not mark it as known exploited. The current feed maps OpenIdentityPlatform/OpenDJ (generic), org.openidentityplatform.opendj/opendj-server-legacy (generic), org.openidentityplatform.opendj:opendj-server-legacy (maven). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps OpenIdentityPlatform/OpenDJ (generic), org.openidentityplatform.opendj/opendj-server-legacy (generic), org.openidentityplatform.opendj:opendj-server-legacy (maven). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| OpenIdentityPlatform/OpenDJgeneric | < 5.1.1 | Not reported |
| org.openidentityplatform.opendj/opendj-server-legacygeneric | < 5.1.1 | Not reported |
| org.openidentityplatform.opendj:opendj-server-legacymaven | <=5.1.0 | 5.1.1 |
Published upstream
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 22, 2026
OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiConnector.java processes attacker-controlled credential objects before authentication without a restrictive jmx.remote.rmi.server.credentials.filter.pattern, and RmiAuthenticator.authenticate in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiAuthenticator.java accepts an unconstrained Object array rather than a two-element String[]. When the JMX Connection Handler is enabled and its TCP listener is reachable, an unauthenticated remote attacker can submit a crafted serialized Java object and achieve code execution in the OpenDJ server process. The handler is disabled by default, and successful exploitation depends on the runtime classpath and Java version; remote code execution was demonstrated against OpenDJ 4.4.15 on JDK 11 with Jackson 2.12.6.1. This issue is fixed in 5.1.1.
Quoted source text, attributed separately from HOL analysis.