CVE-2026-97849
EUVD-2026-12116110.11.2026, 16:17
The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.Enginsight
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources
(CNA/ADP records, vendor advisories, Enginsight analysis).
| Vendor | Product | Version | Source |
|---|---|---|---|
| apache | tomee | 𝑥 ≤ 4.7.5 | CNA |
| apache | tomee | 𝑥 < 10.3.0 | CNA |
Common Weakness Enumeration