Unrated severityNVD Advisory· Published Nov 10, 2026

CVE-2026-86336

Description

Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Affected products

Apache/TomEEllm-fuzzy
Range: before 10.3.0 or 11.0.0-M2

Patches

Vulnerability mechanics

References

lists.apache.org/thread/tv0407xmnpy4qctqm9nzx56lgjln2t4jnvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000