EJB Authorization Bypass in Apache TomEE for JDK 21 and Above

CVE-2026-86336

What is CVE-2026-86336?

The vulnerability allows unauthorized access to Enterprise JavaBeans (EJB) methods in Apache TomEE when running on JDK 21 or later. This flaw occurs because the application skips necessary authorization checks, permitting callers to invoke EJB methods without adhering to the defined access restrictions. This could lead to unauthorized operations within applications, compromising their security integrity. Users are strongly advised to upgrade to the latest versions—10.3.0 or 11.0.0-M2—to mitigate this risk.

References