Vulnerability record/PUBLISHED/Published Nov 10, 2026 15:36:31 UTC
CVE-2026-97849
The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityapache
Last updatedNov 10, 2026 15:36:31 UTC
PublishedNov 10, 2026 15:36:31 UTC
ReservedSep 25, 2026 06:24:27 UTC
Credits
- The Apache Software Foundation
- Claude Security
- Markus Jung