Enterprise Java platforms remain attractive targets because middleware often exposes paths developers assumed were internal. New research presented for Black Hat 2026 describes 12 flaws across products, including a sandbox escape and four pre-authentication issues.
The serious findings are two remote code execution chains affecting Bonita BPM and Apache OFBiz. Both chains begin before login and rely on connections between routing, authentication code, and execution features.
Researchers said every issue was responsibly reported through coordinated disclosure before publication. Administrators should apply updates, review exposed services, and avoid testing systems without authorization. Internal middleware must be treated as exposed.
Bonita BPM version 10.4.3 illustrates how several minor defects can collapse an authentication boundary. Its public API requires a session and CSRF protection.
At the same time, its internal server API service supports authentication and processes XStream XML. Researchers found a path containing encoded semicolons that components interpreted differently.
One security layer considered the request part of the public API, but Tomcat later resolved it toward serverAPI. Regex checks using Matcher. find also accepted harmless substrings. find also accepted harmless substrings.
Finally, the serverAPI constraint did not cover forwarded requests. This allowed an unauthenticated request to reach XStream deserialization, where type permissions and a gadget chain could execute commands.
Apache OFBiz version 24.09.05 led to the same outcome. The resource planning platform supports SSO tokens, widget rendering, Groovy, and FreeMarker templates.
Multiple Vulnerabilities in Enterprise Java Platforms
Researchers at Novee.Security reported that a signing key included in the default configuration was used to validate HMAC-SHA-512 JWTs. On installations where administrators had not replaced the key, attackers could forge a JWT and impersonate an administrator.
That forged identity could set a JavaScriptEnabled preference, a UI flag required before the path could continue. A forged callback token could place a Groovy expression in the areaTarget claim. The widget engine expanded the claim and passed it into an evaluator.
The defense failed because OFBiz used a denylist to inspect expressions before execution. Its pattern was case-sensitive and tried to block words such as java, process, import, and class. Groovy semantics made that approach unreliable.
Alternative class names, capitalization, and imported functions could avoid the listed patterns while preserving behavior. The attack required two GET requests on systems with SSO enabled: one changed the preference, and the other invoked the flow.
It is tracked as CVE-2026-31986 and was rated Critical. The chain shows why signed data must be validated by purpose, type, content, and trust boundary, not by signature.
Defenders should search for these chained weaknesses. Security constraints should protect REQUEST, FORWARD, INCLUDE, and ERROR dispatch paths. Authentication and CSRF filters should compare normalized paths rather than accept substring matches.
Teams should replace shared signing keys, separate keys across trust domains, and rotate secrets. They should remove template evaluation and deserialization where possible.
If a serializer is necessary, strict allowlists and JEP 290 filters can reduce exposure. User preferences and settings must never authorize server-side evaluation.
The finding is that routing decisions, identity tokens, and internal execution services collectively form a single attack surface. Defending that surface requires testing their interactions.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
The post Multiple Flaws in Enterprise Java Platforms Allow Attackers to Execute Remote Code appeared first on Cyber Security News.
