Remote Code Execution Vulnerability in Apache EJB for Default Profile Deployments

CVE-2026-87756

What is CVE-2026-87756?

A vulnerability exists in the Apache EJB system where the internal EJBs responsible for remote deployment and configuration fail to enforce administrative role checks when operated under the default profile. This flaw permits a remote unauthenticated attacker, who can access the remote EJB endpoint, to deploy arbitrary applications and execute code on the server. The risk is limited to installations with system applications enabled and a reachable remote EJB endpoint. Users are strongly advised to upgrade to the latest versions 10.3.0 or 11.0.0-M2 to mitigate this issue.

References