> the vulnerability would make it possible to post server environment variables to any remote server, regardless of JRE version. I've been able to achieve RCE

> the vulnerability would make it possible to post server environment variables to any remote server, regardless of JRE version. I've been able to achieve RCE as well by still using LDAP, but a different lookup mechanism (if you learn about LDAP, you'll quickly realize there's several ways to do this). RCE does not require remote class loading, that's just the easiest way to achieve it. If your JVM triggered the evaluation of any unsafe jndi string, you should assume an RCE is very likely possible on your environment.