Remote Code Execution in EJB Due to Insecure Hessian Protocol Usage by Apache

CVE-2026-97872

What is CVE-2026-97872?

A vulnerability exists when Enterprise JavaBeans (EJB) are exposed using the Hessian protocol in a web application, potentially leading to undeclared security settings. This misconfiguration allows remote unauthenticated attackers to invoke EJB methods, circumventing established authentication and transport security measures. Users are strongly advised to restrict network access to Hessian endpoints from untrusted clients and consider transitioning to more secure remoting protocols to mitigate risks.

References