CVE-2026-86336— Apache TomEE: EJB method authorization is silently skipped on JDK 21+
Quick assessment
Affected
Apache Software Foundation Apache TomEE
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 JDK 21 或更高版本上运行的 Apache TomEE 会跳过 EJB 方法授权检查，导致调用者能够绕过已配置的访问限制，直接调用 EJB 方法。建议用户升级至 10.3.0 或 11.0.0-M2 版本，以修复此问题。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86336
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache TomEE: EJB method authorization is silently skipped on JDK 21+
Source: CVE Program / CVE List V5
Vulnerability Description
Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache TomEE | 10.1.1 ~ 10.3.0 | - |
|
II. Public POCs for CVE-2026-86336
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86336
请登录查看更多情报信息。
Other References for CVE-2026-86336 (1)
-
https://lists.apache.org/thread/tv0407xmnpy4qctqm9nzx56lgjln2t4j vendor-advisory
Same Patch Batch · Apache Software Foundation · 2026-11-10 · 38 CVEs total
| CVE-2026-111260 | Apache TomEE: Predictable OpenID Connect state and nonce values | |
| CVE-2026-111247 | Apache TomEE: Privilege escalation via user name matching a role name | |
| CVE-2026-111248 | Apache TomEE: Authentication with the stored password digest in Tomcat user identity store | |
| CVE-2026-111249 | Apache TomEE: Unauthenticated LiveReload endpoint reachable from the network | |
| CVE-2026-111250 | Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP serve | |
| CVE-2026-111251 | Apache TomEE: Unauthenticated server shutdown via the admin port | |
| CVE-2026-111256 | Apache TomEE: Missing authentication for web service endpoints in embedded HTTP server | |
| CVE-2026-111257 | Apache TomEE: Well-known administrative credentials created at startup | |
| CVE-2026-111258 | Apache TomEE: Security constraint bypass via request routing | |
| CVE-2026-111259 | Apache TomEE: Predictable HTTP session identifiers in embedded server | |
| CVE-2026-111246 | Apache TomEE: HTTP sessions shared across web applications in embedded HTTP server | |
| CVE-2026-111261 | Apache TomEE: Authentication bypass with empty password in LDAP identity store | |
| CVE-2026-111262 | Apache TomEE: LDAP injection in LDAP identity store | |
| CVE-2026-111263 | Apache TomEE: Missing authentication on EJB web service endpoints deployed in a web applic | |
| CVE-2026-111264 | Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP method | |
| CVE-2026-87756 | Apache TomEE: Missing authorization on internal deployer EJBs in default profile | |
| CVE-2026-87755 | Apache TomEE: Stateful session bean hijacking via predictable session identifiers | |
| CVE-2026-86811 | Apache TomEE: Path traversal via stateful EJB passivation | |
| CVE-2026-86532 | Apache TomEE: Username enumeration and timing side channel in JAAS login modules | |
| CVE-2026-97888 | Apache TomEE: Caller identity leaks across requests in embedded HTTP server |
Showing top 20 of 38 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache TomEE
-
CVE-2026-86531
Apache TomEE: DoS via unbounded request body and multipart h -
CVE-2026-87758
Apache TomEE: Missing TLS hostname verification in ejbds cli -
CVE-2026-97849
Apache TomEE: Derby network service listens on all interface -
CVE-2026-97867
Apache TomEE: Database credential disclosure via remote JNDI -
CVE-2026-97870
Apache TomEE: Missing authentication for Hessian endpoints i
Same vendor: Apache Software Foundation
-
CVE-2026-86531
Apache TomEE: DoS via unbounded request body and multipart h -
CVE-2026-87758
Apache TomEE: Missing TLS hostname verification in ejbds cli -
CVE-2026-97849
Apache TomEE: Derby network service listens on all interface -
CVE-2026-97867
Apache TomEE: Database credential disclosure via remote JNDI -
CVE-2026-97870
Apache TomEE: Missing authentication for Hessian endpoints i
Same weakness: CWE-862
-
CVE-2026-111239
Apache TomEE: Code execution by any authenticated user via t -
CVE-2026-125750
Firekylin through 2.18.1 Improper Authorization via Admin RE -
CVE-2026-125745
WCK before 2.4.1 Missing Authorization via wck_show_update_f -
CVE-2026-121191
Improper Access Control Vulnerability in TÜBİTAK BİLGEM's et -
CVE-2026-12266
Authenticated Broken Access Control