CVE-2008-2945: Sun Java System Access Manager 6.3 through 7.1 and Sun Java System Identity Server 6.1 and 6.2 do not prope...

Security readout for executives and security teams

This CVE affects legacy Sun identity and access-management software. A flaw in how XML signatures process XSLT stylesheets could let a context-dependent attacker execute arbitrary code. The business concern is higher when these systems protect authentication or single sign-on, but the provided sources do not show active exploitation. Exposure is likely limited to organizations still running the named legacy Sun Access Manager or Identity Server versions, or products embedding them. Internet-facing SSO, federation, or identity endpoints would increase urgency. The provided affected-product metadata is incomplete beyond the CVE description. Treat as high priority if the affected software remains in use, especially around authentication infrastructure. The issue is old, but legacy identity systems often remain exposed and difficult to replace. Prioritize discovery first because current exposure is the main uncertainty. Mitigation focus: Check Sun Alert 201538 and applicable vendor advisories for supported fixes.; Retire or upgrade unsupported Sun Access Manager and Identity Server deployments.; Identify Avaya or third-party products that may bundle the affected Sun components..

Prepared

Jun 28, 2026, 18:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.