# CVE-2026-123543

Unauthenticated Java deserialization DoS in OpenAM (<16.1.4) can block authentication

- Page: https://www.vulneraibility.com/cve/CVE-2026-123543
- CVSS: 8.7
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.39% (percentile 33.9)
- Weakness: CWE-770
- Also known as: GHSA-x7wr-5gxg-v833
- Published: 2026-11-08

## Affected versions

- OpenIdentityPlatform OpenAM: affected < 16.1.4; fixed in 16.1.4

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote unauthenticated Java deserialization causes resource exhaustion, denying authentication, session validation and policy decisions.

## Action

Immediate action required

## Recommendation

Upgrade to OpenAM 16.1.4+; restrict access to SDK/admin endpoints and apply WAF/rate-limiting

## References

- [advisory] https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-x7wr-5gxg-v833
- [advisory] https://www.vulncheck.com/advisories/openam-before-16.1.4-unauthenticated-dos-via-unbounded-java-deserialisation

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.