CVE-2026-111239: Apache TomEE: Code execution by any authenticated user via the SSH administration shell
The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role. An attacker holding the credentials of any user in that domain, including a low-privileged application user, can execute arbitrary code as the server process. Users are recommended to disable the SSH administration service, or to block network access to it from untrusted clients and restrict its login domain to administrative users.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the optional SSH administration service.
Apache TomEE SSH administration service SSH administration service = disabled - Configuration
Restrict the SSH administration service's configured login domain to administrative users.
Apache TomEE SSH administration service login domain = administrative users only - Compensating control
Block network access to the Apache TomEE SSH administration service from untrusted clients.