CVE-2026-87756: Apache TomEE: Missing authorization on internal deployer EJBs in default profile
Published Nov 10, 2026
·Updated
The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Affected Software
1 affected component
Apache TomEE
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache TomEEto a version that resolves this vulnerability.Fixed in 10.3.0 - Upgrade
Upgrade
Apache TomEEto a version that resolves this vulnerability.Fixed in 11.0.0-M2
Event History
Nov 10, 2026
CVE Published
via MITRE·02:57 PM
Data Sourced
via MITRE·02:57 PM
DescriptionWeakness
Data Sourced
via NVD·03:17 PM
DescriptionWeakness