Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access…
Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Apache Software Foundation
- Product
- Apache TomEE
- Fix
- available
- Weakness
- CWE-862
- Exposure class
- Developer platform, Web platform
- NVD status
- Received
Why it ranks 31 (Notable)
- Product class: developer platform, web platform
- Widely deployed vendor product (Apache Software Foundation)
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-86336 on this site · NVD · CVE.org · Vulnpedia