CVE-2026-87758: Apache TomEE: Missing TLS hostname verification in ejbds client connections
Published Nov 10, 2026
·Updated
The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able to intercept network traffic between an EJB client and server can impersonate the server and read or modify the traffic, including credentials and invocation data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache TomEEto a version that resolves this vulnerability.Fixed in 10.3.0 - Upgrade
Upgrade
Apache TomEEto a version that resolves this vulnerability.Fixed in 11.0.0-M2
Event History
Nov 10, 2026
CVE Published
via MITRE·03:37 PM
Data Sourced
via MITRE·03:37 PM
DescriptionWeakness