The following usages of JDK-internal APIs need to be examined in the java.corba module:

src/java.corba/share/classes/com/sun/corba/se/spi/orb/ORB.java:import jdk.internal.misc.JavaAWTAccess;
src/java.corba/share/classes/com/sun/corba/se/spi/orb/ORB.java:import jdk.internal.misc.SharedSecrets;
src/java.corba/share/classes/sun/corba/Bridge.java:import jdk.internal.misc.Unsafe ;
src/java.corba/share/classes/sun/corba/Bridge.java:import jdk.internal.reflect.ReflectionFactory;
src/java.corba/share/classes/sun/corba/SharedSecrets.java:import jdk.internal.misc.Unsafe;

These are not going to work if java.corba is deployed outside of the JDK, say on the class path.

In the case of ReflectionFactory/Unsafe then it can probably use the sun.reflect/sun.misc versions temporarily (meaning java.corba will depend on jdk.unsupported).

In the case of SharedSecrets/JavaAWTAccess then it requires looking at changes introduced in a security release to see if they are still needed.