https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T23:52:16.548151+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-368480 EUVD-2026-368480 2026-10-02T23:52:16.550968+00:00 EUVD-2026-368480 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47424 fkie_cve-2026-47424 2026-10-02T23:52:16.551016+00:00

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server-side script author to escape the scripting sandbox despite the default class allow and deny lists. A user such as a sub-realm RealmAdmin who can create or edit a script in an executed context can invoke operating-system commands as the OpenAM application server account, crossing the realm-scoped administration boundary and compromising the JVM and every realm it serves. This issue is fixed in version 16.1.1.

 https://cve.radiocsirt.org/vuln/ghsa-69j4-qvqr-hpw3 GHSA-69j4-qvqr-hpw3 — OpenAM Authenticated RCE via Groovy Sandbox Escape 2026-10-02T23:52:16.551054+00:00

Affected: Maven: org.openidentityplatform.openam:openam-scripting

## Summary

**Description**

A Protection Mechanism Failure (CWE-693) in OpenAM's server-side scripting sandbox allows an authenticated script author execute operating-system commands from the OpenAM JVM with the default class allow and deny lists. This impacts OpenAM Community Edition through version 16.0.6. This issue was patched in version 16.1.1.

## Impact An authenticated user (for example, a realm admin) who can create or edit server-side scripts for an executed context can run OS commands as the OpenAM application server admin. For a sub-realm `RealmAdmin`, this crosses the documented boundary from realm-scoped administration to JVM/host execution, effectively compromising the whole OpenAM process and every realm it serves. The sandbox is the only code-level defense between a realm script author and arbitrary JVM/OS execution.

## Patch This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-47424 UBUNTU-CVE-2026-47424 2026-10-02T23:52:16.551095+00:00

Affected: Ubuntu:16.04:LTS: openam

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server-side script author to escape the scripting sandbox despite the default class allow and deny lists. A user such as a sub-realm RealmAdmin who can create or edit a script in an executed context can invoke operating-system commands as the OpenAM application server account, crossing the realm-scoped administration boundary and compromising the JVM and every realm it serves. This issue is fixed in version 16.1.1.