A newly disclosed set of 12 vulnerabilities impacting four enterprise Java platforms, including pre-authentication flaws and a sandbox escape. Presented at Black Hat 2026, the research reveals how overlooked middleware components like routers, servlet dispatchers, SSO handlers, deserializers, and template engines can combine to create complete remote code execution (RCE) chains. The most severe findings affect Bonita BPM 10.4.3 and Apache OFBiz 24.09.05.
Although the products use different frameworks and bug classes, both exploitation paths follow a similar pattern: an unauthenticated request reaches an internal component. Enterprise Java Flaws Bonita segregates its authenticated public /API/ endpoints from the internal /serverAPI/ interface, which supports raw XStream deserialization and is designed for HTTP API users.
According to Novee researchers Lidor Ben Shitrit and Assaf Levkovich, a crafted path can cause different components to interpret URL segments differently. In Dispatch Action (Source: Novee), the security filter identifies the path as belonging to the public API, while Tomcat processes it ultimately forwarding requests to the protected internal API. Novee named the chain SSOnOf(a)biz because it combines a default JWT signing key, forged authentication, a UI preference gate, and unsafe template expansion.
Organizations should review servlet constraints for FORWARD, INCLUDE, and ERROR dispatch coverage; replace partial regex matching with strict path validation; rotate shipped signing keys; and separate cryptographic keys across trust domains.
