Waratek, the leader in runtime application security, today announced the release of its new Reflection Protection rule, a dedicated runtime security feature designed to block exploitation of unsafe reflection and dynamic class-loading vulnerabilities, for both known CVEs and zero-days, without requiring any code changes, application downtime, or complex configuration.
“Every week brings a new CVE, and the gap between disclosure and exploitation keeps shrinking,” said Doug Ennis, CEO of Waratek. “Attackers know that security teams can’t realistically patch every application the moment a vulnerability is announced.”
Unsafe reflection vulnerabilities have exploded in 2026 with a 177.8% year-over-year increase from 2025 so far this year, one of the most significant vulnerability disclosure trends. That puts unsafe reflection vulnerabilities disclosures on pace for more CVEs in this category than the previous three years combined.
This surge is likely correlated with the rapid rise of AI-assisted coding and AI-assisted vulnerability discovery tools, which are simultaneously accelerating the introduction of vulnerable code patterns and the speed at which researchers are uncovering coding flaws. As organizations race to adopt AI-driven development pipelines, this data highlights a widening gap between how fast vulnerable code is released and how prepared runtime defenses are to catch it.
Unsafe reflection is one of the most persistent and dangerous vulnerability classes in Java applications and one of the most common vulnerability patterns in AI-generated code. It allows attacker-controlled input to abuse the reflection API and load arbitrary classes at runtime, often via Class.forName() and similar APIs. Because of the vulnerability’s complexity, it shows up again and again across the Java ecosystem, most commonly, and most dangerously, in JSP loading paths and in expression language evaluators which remain a favorite target for attackers seeking remote code execution resulting in complete compromise of the system.
Two recent, real-world examples illustrate the risk:
- CVE-2026-63317 / CVE-2026-42027: In Apache OpenNLP (versions before 2.5.10 and before 3.0.0-M5), three separate code paths load a class by its fully-qualified name via
Class.forName()and invoke its no-argument constructor without validating the class name or type first. An attacker who can tamper with a model archive or format name can force the application to instantiate an arbitrary class. - CVE-2026-40008: In Apache IoTDB, the pipe processor reads a fully qualified Java class name and instantiates it using
Class.forName().newInstance()with no validation or allowlisting, giving an attacker who controls that input the ability to load and execute arbitrary code.
Both vulnerabilities share the same underlying weakness: unsafe reflection with no guardrails at the point where the class is loaded. Waratek’s new Reflection Protection rule prevents attacks that exploit unsafe reflection vulnerabilities by tracking untrusted data and by hooking into the Reflection API. This addresses the weakness directly, at the runtime layer, regardless of which library, framework, or application introduces it, which means it actively protects against not just these two CVEs, but the broader class of unsafe reflection vulnerabilities yet to be disclosed.
Preemptive Protection, Not Reactive Patching
Traditional, reactive, remediation, requires identifying a specific vulnerability, waiting for a vendor patch, and then testing and deploying that patch across every affected application. Reflection Protection is an active security rule. It closes off unsafe reflection vectors broadly, so any attacks that abuse the root cause of this vulnerability are stopped whether or not the specific vulnerability has been identified, disclosed, or patched yet.
That simplicity is central to the release. Security and engineering teams can enable Reflection Protection directly from the Waratek Portal’s rule wizard, with zero configuration, zero source code modifications, no re-deployment, and no application downtime required. The protection rule is applied at the JVM layer, so it goes into effect immediately across all protected applications.
What teams need are automated detection and remediation tools that work at the runtime layer, closing off entire classes of attack before anyone has to identify the next CVE, write a patch, or schedule a maintenance window. That’s exactly what the Waratek RASP Reflection Protection delivers: active protection that just works the moment you turn it on.
Doug Ennis, CEO of Waratek
Automated Protection for a Threat Landscape That Won’t Wait
“Unsafe reflection vulnerabilities have grown by 525% between 2022 and 2026 and we are still in the middle of 2026.” Apostolos Giannakidis, CTO of Waratek added. “We can no longer run our apps on runtime platforms that are not secure by default.”
“The expectation for runtime platforms now has to be preemptive protection by default against the attack vectors that matter most; those that can hand an attacker complete control of the platform. Unsafe reflection vulnerabilities sit at the very top of this list. If your runtime layer isn’t stopping that by default, it is not keeping pace with the AI-speed zero-day detection.”
Availability
The Reflection Protection rule is available now to Waratek RASP for Java customers and can be enabled in minutes without any configuration.
To see the Reflection Protection rule in action and learn how Waratek’s runtime protection platform defends against known and zero-day vulnerabilities without code changes or downtime, visit Waratek.com to schedule a demonstration.
For more information or to schedule an interview, contact: Doug Ennis, CEO (Douge@waratek.com)
About Waratek
Waratek offers Waratek IAST+RASP, the only compiler-based, runtime application tools that find vulnerabilities in the pre-production development pipeline, block attacks in production, and virtually patch flaws with no downtime or source code changes. Waratek IAST watches code execute to identify security flaws with absolute certainty, eliminating the “guesswork” and alert fatigue associated with traditional scanners. Waratek RASP intercepts and terminates unsafe operations at the JVM level, stopping attempts to change app behavior in attacks aimed at known and Zero Day vulnerabilities. Waratek is a trusted partner for organizations in global financial services, hospitality, healthcare, technology and other industries. Waratek has offices in Dublin, Ireland and Chicago, Illinois.