CVE-2026-86811

EUVD-2026-121214
The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
apacheCNA
UNKNOWN
---
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
apachetomee
𝑥
≤ 4.7.5
CNA
apachetomee
𝑥
< 10.3.0
CNA
Common Weakness Enumeration
References
https://lists.apache.org/thread.html/f2x7r654o1nt2z98m39kk0m6x24mz69f