Unauthenticated Remote Code Execution in Embedded HTTP Server of a Popular Java Framework

CVE-2026-97870

What is CVE-2026-97870?

The vulnerability arises when Hessian remoting endpoints, served through an embedded HTTP server, fail to enforce necessary authentication and transport security protocols. This oversight permits remote, unauthenticated attackers to access and invoke exposed EJB methods without requiring credentials, posing significant security risks if users depend solely on this setup rather than utilizing Tomcat. It is recommended that users restrict access to Hessian endpoints from untrusted sources or consider transitioning to alternative remoting protocols to mitigate potential threats.

References