Enterprise Java platforms remain vulnerable targets due to middleware often exposing paths developers previously thought were internal This article explores supports authentication processes. . New research presented at Black Hat 2026 highlights 12 vulnerabilities across various products, including a sandbox escape and four pre-authentication issues.
The serious findings include remote code execution chains affecting Bonita BPM and Apache OFBiz. Its public API requires a session and CSRF protection; however, its internal server API service supports authentication and processes XStream XML. Finally, the serverAPI constraint did not cover forwarded requests, allowing an unauthenticated request to reach XStream deserialization where type permissions and gadget chains could execute commands. The widget engine expanded the claim before passing it to an evaluator, leading to defense failures due to OFBiz's denylist not inspecting expressions prior to execution.
The attack required two GET requests on systems with SSO enabled: one changed the preference, and the other invoked the flow. The chain highlights why signed data must be validated through purpose, type, content, and trust boundaries, not just by signatures alone. Teams should replace shared signing keys with separate keys across different domains and rotate secrets frequently.
The conclusion is that routing decisions, identity tokens, and internal execution services collectively constitute a single attack surface. Enhance your Security Operations Center (SOC) with accelerated threat detection and swift investigations by integrating ANY.RUN today.
