Skip to content

CVE record · 1 source

CVE-2026-86811

The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it.

Vendor: Apache Software Foundation
Product: Apache TomEE
Weakness: CWE-22
Exposure class: Web platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

25

CVE NVD 2h ago

The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it.

The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read…

Fix available CVE-2026-86811 Apache Software Foundation