CVE-2026-62379 Splunk · SPL

Detect OpenAM Unauthenticated RCE via Class.forName in AuthXMLUtils.createCustomCallback (CVE-2026-62379) in Splunk

OpenAM (org.openidentityplatform.openam:openam-core) versions <= 16.1.1 are vulnerable to unauthenticated remote code execution. The XML-based authentication callback handler AuthXMLUtils.createCustomCallback passes attacker-controlled class names from the authentication request XML directly into Class.forName() and subsequently instantiates the resolved class, allowing an unauthenticated attacker to load and instantiate arbitrary classes on the classpath (CWE-470 Unsafe Reflection) leading to RCE, and reflecting CWE-94 Code Injection. Exploitation requires no authentication and only network access to the OpenAM authentication XML endpoint. A public PoC/advisory exists (GHSA-wg5r-wc3x-39vc). Fixed in OpenAM 16.1.2.

MITRE ATT&CK

Tactic
Initial Access Execution

SPL Detection Query

Splunk (SPL)
spl 
index=web sourcetype=openam:access OR sourcetype=apache:access
| search uri_path="*openam*" (uri_path="*authenticate*" OR uri_path="*AuthXMLUtils*" OR uri_path="*/UI/Login*")
| rex field=_raw "className=(?<className>[A-Za-z0-9_.\$]+)"
| where isnotnull(className)
| eval suspicious=if(match(className, "^(javax\.naming|com\.sun\.org\.apache|org\.apache\.commons\.collections|java\.lang\.(Runtime|ProcessBuilder)|org\.springframework)") OR NOT match(className, "^org\.(forgerock|openidentityplatform)"), 1, 0)
| where suspicious=1
| stats count as attempts, values(className) as sample_classes by src_ip, uri_path, _time span=5m
| where attempts >= 1
critical severity medium confidence

Splunk search identifying unauthenticated OpenAM authentication requests carrying a className field for createCustomCallback whose resolved class falls outside the expected OpenAM/ForgeRock package namespace, indicative of CVE-2026-62379 exploitation attempts.

Data Sources

OpenAM application logsWeb proxy/access logsWAF logs

Required Sourcetypes

openam:accessapache:accessnginx:access

False Positives & Tuning

  • Internal QA harnesses exercising custom callback classes for regression testing
  • Vulnerability scanners with authorized testing windows
  • Misconfigured monitoring agents replaying stale authentication XML payloads

Other platforms for CVE-2026-62379

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate malicious className parameter in OpenAM authentication POST

    Expected signal: HTTP POST request logged in OpenAM access logs / reverse proxy logs containing the className=javax.naming.InitialContext string.

  2. Test 2Unauthenticated request without valid session/authentication headers

    Expected signal: 200/500-level HTTP response captured in access logs alongside the crafted className payload, with no Authorization or session cookie header present.

  3. Test 3Windows-hosted OpenAM proxy log replay test

    Expected signal: IIS/reverse proxy log entry on the Windows collector showing the POST body with the className parameter forwarded to the SIEM.

Last updated: 2026-08-08 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the affected OpenAM/OpenIdentityPlatform deployment version via /openam/json/serverinfo/version or artifact manifest; versions <= 16.1.1 are vulnerable and 16.1.2 contains the fix.
  2. Review the flagged request(s) for the className parameter value and cross-reference against the known-good org.forgerock/org.openidentityplatform namespace to assess intent (recon vs. exploitation).
  3. Check whether the source IP has a history of scanning or prior malicious activity in threat intel feeds and internal SIEM history.
  4. Inspect OpenAM server process for unexpected child processes, newly loaded JAR/class files, or outbound network connections spawned immediately after the suspicious request.

Containment

  1. Immediately restrict or block network access to the OpenAM authentication endpoints (JSON REST /json/authenticate and legacy XML endpoints) from untrusted source IPs via WAF/firewall while remediation is staged.
  2. Isolate the affected OpenAM instance from sensitive downstream systems (LDAP/AD backends, session stores) to limit lateral movement if compromise is confirmed.

Evidence Collection

  1. Preserve full HTTP request/response logs (including raw XML/JSON authentication payloads) from the WAF, reverse proxy, and OpenAM application logs covering the incident window.
  2. Capture a memory/process snapshot and disk forensic image of the OpenAM host if RCE is suspected, prior to remediation actions that would overwrite volatile evidence.

Escalation Criteria

  • !Escalate to incident response if any evidence of successful class instantiation, unexpected process spawning, or outbound C2-like connections is found on the OpenAM host.
  • !Escalate immediately if the OpenAM instance fronts production identity/SSO infrastructure with access to high-value downstream applications, given the unauthenticated 9.8 CVSS RCE nature of this vulnerability.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >OpenAM application/access logs showing className parameters in authentication XML/JSON requests
  • >JVM heap dump or GC logs showing anomalous class loading events around the time of the suspicious request
  • >Process creation logs (Sysmon Event ID 1 / auditd execve) on the OpenAM host correlated to the java process shortly after the malicious request

Tuning Guidance

Build an allowlist of legitimate custom callback class names used by the organization's OpenAM deployment (if any) and exclude them from alerting; tune the 'suspicious' regex/namespace check to match your actual OpenAM package structure, since forks or rebrands may use different base packages. Increase the time window and lower the count threshold in high-security environments given this is a single-shot RCE (no brute force required), and consider alerting on any non-standard className value rather than only a curated suspicious list, since attackers can use arbitrary classpath gadgets not enumerated here. After upgrading to OpenAM 16.1.2+, keep the detection active to catch exploitation attempts against any remaining unpatched instances.

Hunting Queries

Historical hunt across all OpenAM authentication logs to baseline every distinct className value ever submitted, surfacing rare or anomalous classes that warrant manual review even if they weren't caught by the real-time detection thresholds.

Hunting — KQL
kql 
OpenAMAuthXMLLogs
| where RequestBody has "className"
| extend ExtractedClass = extract(@"className=[\"']?([A-Za-z0-9_.\$]+)", 1, RequestBody)
| summarize Count=count(), Sources=make_set(RemoteIP) by ExtractedClass
| order by Count desc
Hunting — SPL
spl 
index=web sourcetype=openam:access
| rex field=_raw "className=(?<className>[A-Za-z0-9_.\$]+)"
| stats count, values(src_ip) as sources by className
| sort -count

Atomic Red Team Tests

Test 1 Simulate malicious className parameter in OpenAM authentication POST
linux

Sends a crafted POST request to a lab OpenAM authentication endpoint with a className parameter pointing to a non-OpenAM class, simulating the Class.forName injection technique without requiring an actual RCE payload.

Command

bash 
curl -s -X POST 'http://LAB_OPENAM_HOST:8080/openam/json/authenticate' -H 'Content-Type: application/json' -d '{"callbacks":[{"type":"CustomCallback","className":"javax.naming.InitialContext"}]}'

Cleanup

bash 
No persistent changes made; clear any temporary lab logs with: truncate -s 0 /var/log/openam/access.log (lab only)

Expected Telemetry

HTTP POST request logged in OpenAM access logs / reverse proxy logs containing the className=javax.naming.InitialContext string.

Expected Detection

KQL, SPL, and Elastic EQL rules fire on the className parameter matching a suspicious/non-OpenAM namespace class.

Test 2 Unauthenticated request without valid session/authentication headers
linux

Verifies that the vulnerable endpoint is reachable and processes the crafted callback without any prior authentication, confirming pre-auth exposure in a lab environment.

Command

bash 
curl -s -i -X POST 'http://LAB_OPENAM_HOST:8080/openam/json/authenticate' -H 'Content-Type: application/json' --data '{"callbacks":[{"type":"CustomCallback","className":"com.sun.org.apache.xalan.internal.xsltc.trax.TrustedTransformerFactoryImpl"}]}' | head -n 20

Cleanup

bash 
No persistent state changes; rotate/clear lab access logs if needed.

Expected Telemetry

200/500-level HTTP response captured in access logs alongside the crafted className payload, with no Authorization or session cookie header present.

Expected Detection

SIEM rule confirms alert fires even absent authentication headers, validating unauthenticated exposure detection logic.

Test 3 Windows-hosted OpenAM proxy log replay test
windows

Replays a captured (sanitized) malicious authentication payload against a Windows-hosted reverse proxy/log collector to validate that Windows-based log forwarding pipelines correctly surface the className field for detection.

Command

powershell 
Invoke-WebRequest -Uri 'http://LAB_OPENAM_HOST:8080/openam/json/authenticate' -Method POST -ContentType 'application/json' -Body '{"callbacks":[{"type":"CustomCallback","className":"org.apache.commons.collections.functors.InvokerTransformer"}]}'

Cleanup

powershell 
No system changes persist on the Windows test host; clear PowerShell history entry for this command if required by lab policy.

Expected Telemetry

IIS/reverse proxy log entry on the Windows collector showing the POST body with the className parameter forwarded to the SIEM.

Expected Detection

QRadar AQL and Sumo Logic queries match the forwarded log entry, confirming cross-platform log pipeline coverage for the detection.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter

Same Tactic: Initial Access

Popular Detections