Critical Remote Code Execution Flaws in Enterprise Java Platforms Uncovered

Research presented at Black Hat 2026 revealed 12 vulnerabilities in major Enterprise Java platforms, including serious remote code execution (RCE) chains affecting Bonita BPM and Apache OFBiz. These vulnerabilities allow unauthenticated attackers to exploit middleware components, beginning before user login. The findings include a sandbox escape and four pre-authentication issues. The vulnerabilities pose significant risks to organizations relying on these platforms, as they can lead to unauthorized access and control over systems. The research highlights the importance of securing middleware components that may be mistakenly assumed to be internal. Security professionals are urged to assess their systems for these vulnerabilities and implement necessary mitigations. The full list of CVEs has not been disclosed yet, but the implications are severe.

Key Points: • 12 vulnerabilities identified in Enterprise Java platforms, including RCE chains. • Affected systems include Bonita BPM and Apache OFBiz, exploitable pre-authentication. • Security professionals advised to assess and mitigate risks associated with middleware.