CVE-2026-87756

EUVD-2026-121216

10.11.2026, 15:17

The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
apache	CNA	UNKNOWN				---

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).

Vendor	Product	Version	Source
apache	tomee	4.5.1 ≤ 𝑥 ≤ 4.7.5	CNA
apache	tomee	𝑥 < 10.3.0	CNA

Common Weakness Enumeration

CWE-306 - Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References

https://lists.apache.org/thread.html/4748mnztpzyfcy840z143ttgj92yl84r