CVE-2026-86336: Apache TomEE: EJB method authorization is silently skipped on JDK 21+

Published Nov 10, 2026

Updated

Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache TomEE to a version that resolves this vulnerability.
Fixed in 10.3.0
Upgrade
Upgrade Apache TomEE to a version that resolves this vulnerability.
Fixed in 11.0.0-M2

Event History

Nov 10, 2026

CVE Published

via MITRE·03:38 PM

Data Sourced

via MITRE·03:38 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache TomEE deployments running on JDK 21 or later are affected when they rely on EJB method authorization checks to enforce configured access restrictions.

What does an attacker need to exploit this?

A caller needs the ability to invoke an EJB method. The affected runtime skips the configured EJB method authorization check, so the caller may invoke methods without the intended access restrictions being enforced.

How can this be remediated?

Upgrade Apache TomEE to version 10.3.0 or 11.0.0-M2, which fix the issue.

CVE-2026-86336: Apache TomEE: EJB method authorization is silently skipped on JDK 21+

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit this?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit this?

How can this be remediated?