CVE-2026-87756
Apache TomEE: Missing authorization on internal deployer EJBs in default profile
The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
What each source reports
CVE List No score
Apache TomEE: Missing authorization on internal deployer EJBs in default profile
The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
- Record
CVE-2026-87756- Weakness
- CWE-306
- Updated
- 2026-11-10
EUVDEUVD-2026-121216 No score
The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
- Record
EUVD-2026-121216- Updated
- 2026-11-10
GitHub AdvisoriesGHSA-52g3-qw9c-qp2m No score
The internal system EJBs used for remote deployment and configuration did not enforce their...
The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
- Record
GHSA-52g3-qw9c-qp2m- Weakness
- CWE-306
- Updated
- 2026-11-10
NVD No score
The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
- Record
CVE-2026-87756- Weakness
- CWE-306
- Updated
- 2026-11-10
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| published | EUVD | |
| aliases | EUVD | |
| aliases, references | GitHub Advisories | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-87756 is a vulnerability with no CVSS score yet in Apache Software Foundation Tomee, published November 10, 2026. No source lists public exploit code. No source names a fixed version.