ARTICLE AD BOX
You’re hitting two separate but related issues caused by moving to JDK 25:
sun.security.action.GetPropertyAction is an internal JDK class that is no longer accessible (and effectively removed for external use). CORBA/IIOP support was removed from the JDK starting in Java 11 (JEP 320), so anything relying on the built-in ORB will not work on JDK 25.There is no supported way to re-enable the old CORBA/IIOP stack in JDK 25.
Why your application breaks Your JMS client is using IIOP (likely via JNDI with a CORBA-based provider). That stack depends on:
The old JDK CORBA implementation (removed) Internal sun.* classes (now strongly encapsulated/absent)Even if you work around the sun.* access, the CORBA transport itself is gone, so the client cannot function.
What will NOT work
Downgrading compiler flags or adding --add-exports is not a real solution in JDK 25. Adding --add-opens or similar may bypass some reflective access in older JDKs, but does not restore CORBA. There is no official replacement for java.corba inside the JDK.Viable options
1) Replace IIOP with a supported transport (recommended)
Check whether your JMS provider supports a non-IIOP protocol:
Direct TCP-based JMS client Vendor “thin client” HTTP-based JMS endpoints
Examples:
IBM MQ: use the MQ JMS client over TCP instead of IIOP WebSphere: use thin client libraries instead of CORBA-based JNDI
This is the only clean solution that works natively on JDK 25.
2) Use an external CORBA implementation
You can try adding a third-party ORB such as JacORB.
This requires:
Adding CORBA libraries manually Reconfiguring ORB initialization Ensuring your JMS provider supports a non-vendor-specific ORB
In practice, this often fails with older enterprise servers (e.g., WebSphere) because they rely on proprietary ORB behavior.
3) Introduce a bridge service (common enterprise workaround)
Run the legacy integration on an older JDK that still works (e.g., 8 or 17), and connect your JDK 25 application to it via a modern protocol.
Architecture:
Legacy service (JDK 8/11/17): Connects via IIOP Consumes JMS messages New service (JDK 25): Communicates via REST, HTTP, Kafka, etc.
This isolates the unsupported technology while allowing the main system to run on JDK 25.
4) Migrate the server side (long-term)
If you control the JMS server:
Disable IIOP Enable modern protocols (TCP, AMQP, HTTP) Upgrade middleware if necessary
About the specific error
NoClassDefFoundError: sun/security/action/GetPropertyAction
This indicates a dependency (likely your JMS client or CORBA stack) is using internal JDK APIs.
Even if you try:
--add-exports java.base/sun.security.action=ALL-UNNAMED
this is not reliable in JDK 25 and does not solve the missing CORBA implementation.
Bottom line
JDK 25 does not support CORBA/IIOP. Your current approach (JMS over IIOP using JDK-provided CORBA) cannot be made to work directly. You must either: Switch to a non-IIOP JMS client, or Use a bridge service on an older JDK, or Attempt (with risk) a third-party CORBA ORB.