CVE-2026-97849: Apache TomEE: Derby network service listens on all interfaces

Published Nov 10, 2026

Updated

The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache TomEE to a version that resolves this vulnerability.
Fixed in 10.3.0
Upgrade
Upgrade Apache TomEE to a version that resolves this vulnerability.
Fixed in 11.0.0-M2

Event History

Nov 10, 2026

CVE Published

via MITRE·03:36 PM

Data Sourced

via MITRE·03:36 PM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Deployments with the embedded Derby network service enabled are exposed if they are reachable by an attacker over the network. The service may be reachable on any network interface because its configured bind address is ignored.

What does an attacker need to exploit it?

An attacker needs network access to the Derby database server. No additional prerequisites are stated.

What is the impact of successful exploitation?

A remote attacker can connect to the database server and read or modify data.

What versions address the issue?

Upgrade to Apache TomEE version 10.3.0 or 11.0.0-M2, which fix the issue.

CVE-2026-97849: Apache TomEE: Derby network service listens on all interfaces

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What versions address the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What versions address the issue?