Applications that contain their own copy of the Hibernate ORM jars, need to be deployed with a permissions.xml that grant Hibernate ORM/Validator the following permissions:

<permissions xmlns="http://xmlns.jcp.org/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
http://xmlns.jcp.org/xml/ns/javaee/permissions_7.xsd"
version="7">
<permission>
<class-name>java.lang.RuntimePermission</class-name>
<name>createClassLoader</name>
<actions>read</actions>
</permission>
<permission>
<class-name>java.lang.RuntimePermission</class-name>
<name>getClassLoader</name>
<actions>read</actions>
</permission>
<permission>
<class-name>org.jboss.vfs.VirtualFilePermission</class-name>
<name>/-</name>
<actions>read</actions>
</permission>
<permission>
<class-name>java.lang.reflect.ReflectPermission</class-name>
<name>suppressAccessChecks</name>
</permission>
</permissions>