CVE-2026-47424 OpenIdentityPlatform CVE debrief

Who should care

Defenders responsible for OpenAM deployments, especially those with exposed script execution contexts, should prioritize patching and restrict script authoring privileges to minimize the attack surface.

Why it matters

CVE-2026-47424 is a high-severity vulnerability in OpenAM that allows authenticated script authors to execute system commands, potentially compromising the JVM and all served realms. Defenders should prioritize patching to version 16.1.1 or later and restrict script authoring privileges.

• Authenticated command execution as the OpenAM application server account
• Potential compromise of the JVM and every realm it serves
• Elevation of privileges for script authors
• Bypass of scripting sandbox restrictions

Technical summary

CVE-2026-47424 is a high-severity vulnerability in Open Access Management (OpenAM) that allows an authenticated server-side script author to escape the scripting sandbox and execute operating-system commands as the OpenAM application server account. This issue, fixed in version 16.1.1, can compromise the JVM and every realm it serves. The vulnerability is caused by a flaw in the GroovySandboxValueFilter, which permits script authors to bypass sandbox restrictions. Defenders should prioritize patching OpenAM instances and restrict script authoring privileges to minimize the attack surface.

Defensive priority

Defenders should prioritize patching OpenAM instances, especially those with exposed script execution contexts, and restrict script authoring privileges.

Recommended defensive actions

• Patch OpenAM instances to version 16.1.1 or later
• Restrict script authoring privileges to minimize the attack surface
• Monitor for suspicious script execution activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. However, additional information on affected deployments and exploitation attempts is limited. There is no evidence of public exploitation, but defenders should verify the patch status of OpenAM instances and review script execution contexts for potential exposure. The CVE Program and NVD entries provide source-provided CVE metadata and official vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.