Vulnerability record/PUBLISHED/Published Nov 10, 2026 15:33:58 UTC
CVE-2026-97874
When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityapache
Last updatedNov 10, 2026 15:33:58 UTC
PublishedNov 10, 2026 15:33:58 UTC
ReservedSep 25, 2026 08:43:57 UTC
Credits
- The Apache Software Foundation
- Claude Security
- Markus Jung