IBM and Red Hat’s Lightwell service pairs a $712 million savings model with embargoed fixes for paying customers. Security teams still have little public data to verify the claims
More than 400 previously unknown vulnerabilities in widely used Java libraries have been fixed through a new IBM and Red Hat remediation service. Only one of them has so far been publicly disclosed with a CVE identifier.
IBM and Red Hat announced the milestone on Oct. 6. The announcement came alongside the general availability of Lightwell Clearinghouse, a service that lets enterprise customers submit specific open source dependencies for priority review and fixes. Those fixes include backports to older versions still running in production.
“AI agents shifted the threat landscape overnight, exploiting old dependencies at machine speed,” Gunnar Hellekson, vice president and general manager of Lightwell at Red Hat, said in the announcement.
The public record remains thin. A Red Hat blog post published Oct. 13 identified a flaw in the Eclipse Implementation of Jakarta XML Binding (JAXB), tracked as CVE-2026-92877. The post described it as “the first publicly-disclosed novel CVE from Lightwell.”
One public CVE, few details
The blog post did not give a CVSS score or list affected versions. It also did not describe an exploitation scenario. Red Hat said in the post that parsing bugs of this kind could be chained with other flaws to escalate privileges or run arbitrary code. It added that malformed payloads could exhaust resources and halt critical services.
The upstream fix is pull request #2013 to the eclipse-ee4j JAXB repository, titled “Complete hardening.” Its code changes configure JAXB’s XML parser factories to reject DOCTYPE declarations. That is a standard defense against XML external entity (XXE) attacks
JAXB shipped inside the JDK through Java 8. From Java 11 onward, applications must pull it in separately, often as a transitive dependency, Red Hat said in a separate report. That can hide exposure from teams that track only direct dependencies.
Embargoes for paying customers
Red Hat said in the Oct. 6 announcement that applicable Lightwell fixes are contributed upstream under responsible disclosure protocols. The same announcement said Lightwell maintains embargo protections for Clearinghouse participants.
The company has not said how long those embargoes last. It also has not said how many of the 400 fixes have reached upstream projects or received CVE identifiers.
Hellekson’s warning cuts both ways. Red Hat argues that agents chain old bugs at machine speed. If that is true, every week a fix stays under embargo for paying customers is a week when everyone else runs the same vulnerable code.
A $712 million model
Red Hat’s inaugural Open Source Security Signals report, published Oct. 15, uses the JAXB flaw to model the value of a single reusable fix. It estimates that 285,000 Java applications worldwide could be running an affected version. It puts the cost of fixing them independently at 5.7 million engineering hours, or $712.5 million.
Those figures rest on layered assumptions. The report starts from 3 million production Java applications, which it describes as a modeling baseline rather than an observed count. It assumes that 90% of Java 8 applications use XML functionality that could rely on JAXB. It then applies vulnerable-version persistence rates drawn from Sonatype and OpenLogic research.
The report also claims 81.8% faster remediation. That figure compares an industry average of 54.81 days with a 10-day turnaround. The report calls the 10-day figure “a modeled scenario, not an observed Lightwell customer benchmark.”
To argue that severity scores alone are no longer enough, the report cites IBM X-Force analysis of 223 vulnerabilities discovered using frontier AI models. Of those, 55.2% were rated High or Critical, 91% were remotely accessible and 25.6% supported code execution. IBM owns Red Hat.
Dependency debt is the larger problem. The report cites Veracode research showing that third-party flaws found through software composition analysis have a remediation half-life of 358 days.
Red Hat said future editions of the report will track how quickly meaningful vulnerabilities are assessed and remediated across the open source ecosystem.
