Enterprise Java Vulnerabilities Enable Pre

Gbhackers •Divya • August 7, 2026

Security research presented at Black Hat 2026 has identified 12 vulnerabilities across four enterprise Java platforms, including two critical pre-authentication remote code execution (RCE) chains affecting Bonita BPM and Apache OFBiz. Researchers Lidor Ben Shitrit and Assaf Levkovich demonstrated how seemingly minor middleware vulnerabilities, such as differences in URL parsing, incomplete servlet protections, hardcoded cryptographic […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Remote Code Execution Flaws in Enterprise Java Platforms Uncovered Research presented at Black Hat 2026 revealed 12 vulnerabilities in major Enterprise Java platforms, including serious remote code execution (RCE) chains affecting Bonita BPM and Apache OFBiz. These vulnerabilities allow unauthenticated attackers to exploit middleware components, beginning before user login. The findings include a sandbox escape and four pre-authentication issues. The vulnerabilities pose significant risks to organizations relying on these platforms, as they can lead to unauthorized access and control over systems. The research highlights the importance of securing middleware components that may be mistakenly assumed to be internal. Security professionals are urged to assess their systems for these vulnerabilities and implement necessary mitigations. The full list of CVEs has not been disclosed yet, but the implications are severe. 3 sources 71

Extracted Entities

Platforms (2)

Apache OFBiz Bonita BPM