CVE-2026-86336

UNKNOWN 0.0

Apache TomEE: EJB method authorization is silently skipped on JDK 21+

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

CWE	CWE-862
Vendor	apache software foundation
Product	apache tomee
Published	Nov 10, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache tomee

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache tomee are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache TomEE

10.1.1 < 10.3.0 11.0.0-M1 < 11.0.0-M2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/tv0407xmnpy4qctqm9nzx56lgjln2t4j

Credits

The Apache Software Foundation Claude Security Markus Jung