Remote Code Execution in Stateful Session Bean Mechanism by Vendor Name Product
CVE-2026-86811
Currently unrated
What is CVE-2026-86811?
A vulnerability exists in the stateful session bean passivation mechanism, where the on-disk file name is derived from an unvalidated client-supplied identifier. This flaw allows a remote attacker with access to the remote EJB service to manipulate session state, potentially leading to the reading from or writing to files that are located outside the designated passivation directory. It is highly advisable for users to upgrade to versions 10.3.0 or 11.0.0-M2 to eliminate this risk.
Affected Version(s)
Apache TomEE 4.0.0-beta-1 <= 4.7.5
Apache TomEE 7.0.0-M1 < 10.0.0-M1
Apache TomEE 10.0.0-M1 < 10.3.0