CVE-2026-87756— Apache TomEE: Missing authorization on internal deployer EJBs in default profile
Quick assessment
Affected
Apache Software Foundation Apache TomEE
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
用于远程部署和配置的内部系统 EJB 在服务器使用默认配置文件运行时，未强制执行其管理角色检查。能够访问远程 EJB 端点的远程未认证攻击者可部署任意应用程序并执行代码。仅启用了系统应用程序且暴露了远程 EJB 端点的安装环境会受到此漏洞影响。建议用户升级至 10.3.0 或 11.0.0-M2 版本，以修复该问题。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-87756
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache TomEE: Missing authorization on internal deployer EJBs in default profile
Source: CVE Program / CVE List V5
Vulnerability Description
The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache TomEE | 4.5.1 ~ 4.7.5 | - |
|
| Apache Software Foundation | Apache TomEE | 7.0.0-M1 ~ 10.0.0-M1 | - |
|
II. Public POCs for CVE-2026-87756
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-87756
请登录查看更多情报信息。
Other References for CVE-2026-87756 (1)
Same Patch Batch · Apache Software Foundation · 2026-11-10 · 38 CVEs total
| CVE-2026-111259 | Apache TomEE: Predictable HTTP session identifiers in embedded server | |
| CVE-2026-111246 | Apache TomEE: HTTP sessions shared across web applications in embedded HTTP server | |
| CVE-2026-111247 | Apache TomEE: Privilege escalation via user name matching a role name | |
| CVE-2026-111248 | Apache TomEE: Authentication with the stored password digest in Tomcat user identity store | |
| CVE-2026-111249 | Apache TomEE: Unauthenticated LiveReload endpoint reachable from the network | |
| CVE-2026-111250 | Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP serve | |
| CVE-2026-111251 | Apache TomEE: Unauthenticated server shutdown via the admin port | |
| CVE-2026-111256 | Apache TomEE: Missing authentication for web service endpoints in embedded HTTP server | |
| CVE-2026-111257 | Apache TomEE: Well-known administrative credentials created at startup | |
| CVE-2026-111258 | Apache TomEE: Security constraint bypass via request routing | |
| CVE-2026-111245 | Apache TomEE: Privilege escalation via WS-Security caller identity leaking between request | |
| CVE-2026-111260 | Apache TomEE: Predictable OpenID Connect state and nonce values | |
| CVE-2026-111261 | Apache TomEE: Authentication bypass with empty password in LDAP identity store | |
| CVE-2026-111262 | Apache TomEE: LDAP injection in LDAP identity store | |
| CVE-2026-111263 | Apache TomEE: Missing authentication on EJB web service endpoints deployed in a web applic | |
| CVE-2026-111264 | Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP method | |
| CVE-2026-87755 | Apache TomEE: Stateful session bean hijacking via predictable session identifiers | |
| CVE-2026-86811 | Apache TomEE: Path traversal via stateful EJB passivation | |
| CVE-2026-86532 | Apache TomEE: Username enumeration and timing side channel in JAAS login modules | |
| CVE-2026-97881 | Apache TomEE: Path traversal in embedded HTTP server static resource handling |
Showing top 20 of 38 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache TomEE
-
CVE-2026-86336
Apache TomEE: EJB method authorization is silently skipped o -
CVE-2026-86531
Apache TomEE: DoS via unbounded request body and multipart h -
CVE-2026-87758
Apache TomEE: Missing TLS hostname verification in ejbds cli -
CVE-2026-97849
Apache TomEE: Derby network service listens on all interface -
CVE-2026-97867
Apache TomEE: Database credential disclosure via remote JNDI
Same vendor: Apache Software Foundation
-
CVE-2026-86336
Apache TomEE: EJB method authorization is silently skipped o -
CVE-2026-86531
Apache TomEE: DoS via unbounded request body and multipart h -
CVE-2026-87758
Apache TomEE: Missing TLS hostname verification in ejbds cli -
CVE-2026-97849
Apache TomEE: Derby network service listens on all interface -
CVE-2026-97867
Apache TomEE: Database credential disclosure via remote JNDI
Same weakness: CWE-306
-
CVE-2026-123180
Missing Authentication Vulnerability in NETGEAR Nighthawk RA -
CVE-2026-97870
Apache TomEE: Missing authentication for Hessian endpoints i -
CVE-2026-97872
Apache TomEE: Authentication bypass of Hessian EJB endpoints -
CVE-2026-121683
Ivanti 5.0.8 云应用存在认证绕过漏洞 -
CVE-2026-111251
Apache TomEE: Unauthenticated server shutdown via the admin