CVE-2026-86336
Apache TomEE: EJB method authorization is silently skipped on JDK 21+
Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
What each source reports
CVE List No score
Apache TomEE: EJB method authorization is silently skipped on JDK 21+
Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
- Record
CVE-2026-86336- Weakness
- CWE-862
- Updated
- 2026-11-10
EUVDEUVD-2026-121262 No score
Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
- Record
EUVD-2026-121262- Updated
- 2026-11-10
GitHub AdvisoriesGHSA-pfgh-rfc5-q7f6 No score
Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers...
Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
- Record
GHSA-pfgh-rfc5-q7f6- Weakness
- CWE-862
- Updated
- 2026-11-10
NVD No score
Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
- Record
CVE-2026-86336- Weakness
- CWE-862
- Updated
- 2026-11-10
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| published | EUVD | |
| published | EUVD | |
| aliases, references | GitHub Advisories, NVD | |
| aliases, published | EUVD | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-86336 is a vulnerability with no CVSS score yet in Apache Software Foundation Tomee, published November 10, 2026. No source lists public exploit code. No source names a fixed version.