← CVE index
Vulnerability record/PUBLISHED/Published Nov 10, 2026 15:37:08 UTC

CVE-2026-87758

The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able to intercept network traffic between an EJB client and server can impersonate the server and read or modify the traffic, including credentials and invocation data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Base scoreN/A/ 10
SeverityNoneCVSS unscored

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes
Base severityNone
No CVSS vector is available for this record.

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authorityapache
Last updatedNov 10, 2026 15:37:08 UTC
PublishedNov 10, 2026 15:37:08 UTC
ReservedSep 9, 2026 07:17:54 UTC

Credits

  • The Apache Software Foundation
  • Claude Security
  • Markus Jung