CVE-2026-87755: Apache TomEE: Stateful session bean hijacking via predictable session identifiers

Q: Who is exposed to this issue?

Deployments that expose an EJB remote endpoint are exposed. An attacker must be able to access that endpoint and possess one valid stateful session bean identifier.

Q: What can an attacker do with a valid identifier?

They may be able to derive identifiers for other clients' stateful sessions and invoke methods on those beans. This can expose or modify other users' session state.

Q: Which versions address the issue?

Upgrade to Apache TomEE 10.3.0 or 11.0.0-M2, which are identified as fixing the issue.

Published Nov 10, 2026

Updated

Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other users' session state. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Affected Software

1 affected component

Apache TomEE<10.3.0, <11.0.0-M2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache TomEE to a version that resolves this vulnerability.
Fixed in 10.3.0
Upgrade
Upgrade Apache TomEE to a version that resolves this vulnerability.
Fixed in 11.0.0-M2

Event History

Nov 10, 2026

CVE Published

via MITRE·02:56 PM

Data Sourced

via MITRE·02:56 PM

DescriptionWeakness

Data Sourced

via NVD·03:17 PM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Deployments that expose an EJB remote endpoint are exposed. An attacker must be able to access that endpoint and possess one valid stateful session bean identifier.

What can an attacker do with a valid identifier?

They may be able to derive identifiers for other clients' stateful sessions and invoke methods on those beans. This can expose or modify other users' session state.

Which versions address the issue?

Upgrade to Apache TomEE 10.3.0 or 11.0.0-M2, which are identified as fixing the issue.

CVE-2026-87755: Apache TomEE: Stateful session bean hijacking via predictable session identifiers

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What can an attacker do with a valid identifier?

Which versions address the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What can an attacker do with a valid identifier?

Which versions address the issue?