{"id":"CVE-2026-87756","aliases":[],"cve":{"records":[{"id":"CVE-2026-87756","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-09T07:08:03.642Z","published":"2026-11-10T14:57:19.763Z","modified":"2026-11-10T14:57:19.763Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-10T14:57:19.763Z"}],"references":[{"url":"https://lists.apache.org/thread.html/4748mnztpzyfcy840z143ttgj92yl84r","tags":["vendor-advisory"],"source":"apache"}],"weaknesses":[{"id":"CWE-306","description":"CWE-306 Missing Authentication for Critical Function","source":"apache"}],"applicability":[],"prioritization":[]},"title":"Apache TomEE: Missing authorization on internal deployer EJBs in default profile","titleSource":"apache","descriptionSource":"apache","description":"The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","score":null,"severity":"unknown","published":"2026-11-10T14:57:19.763Z","modified":"2026-11-10T14:57:19.763Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache TomEE","platforms":[],"versions":[{"version":"4.5.1","status":"affected","lessThanOrEqual":"4.7.5","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.openejb/openejb-core","packageIdentity":{"ecosystem":"Maven","name":"org.apache.openejb:openejb-core"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-87756"},{"vendor":"Apache Software Foundation","name":"Apache TomEE","platforms":[],"versions":[{"version":"7.0.0-M1","status":"affected","lessThan":"10.0.0-M1","versionType":"semver"},{"version":"10.0.0-M1","status":"affected","lessThan":"10.3.0","versionType":"semver"},{"version":"11.0.0-M1","status":"affected","lessThan":"11.0.0-M2","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.tomee/openejb-core","packageIdentity":{"ecosystem":"Maven","name":"org.apache.tomee:openejb-core"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-87756"}],"remediation":[],"references":["https://lists.apache.org/thread.html/4748mnztpzyfcy840z143ttgj92yl84r"],"sources":[{"name":"CVE","id":"CVE-2026-87756","modified":"2026-11-10T14:57:19.763Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-87756"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-11-10T15:16:22.285Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T04:30:30.387Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-10T15:20:35.290Z","attemptedAt":"2026-11-10T15:20:35.290Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-10T15:20:35.466Z","attemptedAt":"2026-11-10T15:20:35.466Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-10T15:20:35.783Z","attemptedAt":"2026-11-10T15:20:35.783Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T15:20:35.331Z","attemptedAt":"2026-11-10T15:20:35.331Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-87756","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87756","modified":"2026-11-10T15:17:30.603","checkedAt":"2026-11-10T15:20:35.290Z"}],"aiSummary":{"text":"Apache TomEE versions up to 4.7.5, 7.0.0-M1 to 10.0.0-M1, and 11.0.0-M1 to 11.0.0-M2 have a missing authorization weakness, allowing a remote unauthenticated attacker to deploy applications if the system applications and remote EJB endpoint are enabled. The impact is code execution. Only certain installations are exposed.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T15:21:09.530Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-87756"}]}}