Vulnerability record/PUBLISHED/Published Nov 10, 2026 15:38:27 UTC
CVE-2026-86336
Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityapache
Last updatedNov 10, 2026 15:38:27 UTC
PublishedNov 10, 2026 15:38:27 UTC
ReservedSep 7, 2026 08:15:22 UTC
Credits
- The Apache Software Foundation
- Claude Security
- Markus Jung