{"id":"CVE-2026-111264","kind":"vulnerability","aliases":["CVE-2026-111264"],"related":[],"title":"JBoss EJB JAX-WS endpoints: authentication skipped for some HTTP methods","description":"The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","summary":"The security constraint generated for EJB JAX-WS endpoints with configured authentication covers only some HTTP methods. A remote unauthenticated attacker can reach these endpoints by sending requests with a different HTTP method and bypass authentication.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ejb","java","jax-ws","jboss","runtime"],"not_affected_if":["no-ejb-authentication","no-jax-ws-endpoints"],"how_to_check":"- Check whether the application exposes EJB JAX-WS web service endpoints that use configured authentication (`unknown` if the sources do not say which versions or configurations are affected)\n- Check the server version against the fixed releases: `unknown` for the affected range","fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, which the source states fix the issue","status":"open","published_at":"2026-11-10T15:17:12+00:00","first_seen_at":"2026-11-10T15:22:22+00:00","triaged_at":"2026-11-10T15:22:55+00:00","updated_at":"2026-11-10T15:22:55+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-10T15:22:55Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, which the source states fix the issue","reach":"internet","title":"JBoss EJB JAX-WS endpoints: authentication skipped for some HTTP methods","impact":"high","summary":"The security constraint generated for EJB JAX-WS endpoints with configured authentication covers only some HTTP methods. A remote unauthenticated attacker can reach these endpoints by sending requests with a different HTTP method and bypass authentication.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["jboss","ejb","jax-ws","java"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Remote attacker reaches protected web service endpoints without credentials","analyst_note":"Confirm the affected version range and the product (likely a JBoss/WildFly-family server) from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111264.","how_to_check":"- Check whether the application exposes EJB JAX-WS web service endpoints that use configured authentication (`unknown` if the sources do not say which versions or configurations are affected)\n- Check the server version against the fixed releases: `unknown` for the affected range","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-jax-ws-endpoints","no-ejb-authentication"],"who_is_affected":"Applications that expose EJB JAX-WS web service endpoints with authentication configured are exposed, because the generated security constraint misses some HTTP methods. Applications without EJB JAX-WS endpoints, or without configured authentication on them, are not affected by this description. The sources do not name the exact affected product line.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000773,"input_tokens":4552,"output_tokens":636,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111264':15A,18A '-2026':14A,17A '10.3.0':102C '11.0.0':104C 'anoth':92C 'attack':47B,84C 'authent':7A,38B,62B,75C,87C 'bypass':61B,86C 'configur':37B,74C 'constraint':28B,65C 'cover':39B 'cve':13A,16A 'differ':57B 'ejb':2A,19B,31B,68C 'endpoint':6A,35B,51B,72C 'fix':107C 'generat':29B,66C 'http':11A,42B,58B,79C,93C 'issu':109C 'java':20B 'jax':4A,22B,33B,70C 'jax-w':3A,21B,32B,69C 'jboss':1A,24B 'm2':105C 'method':12A,43B,59B,80C,94C 'protect':76C 'reach':49B 'recommend':97C 'remot':45B,82C 'request':54B,90C 'runtim':25B 'secur':27B,64C 'send':53B,89C 'skip':8A 'unauthent':46B,83C 'upgrad':99C 'user':95C 'version':101C 'ws':5A,23B,34B,71C","nicknames":[],"mitigations":[],"who_affected":"Applications that expose EJB JAX-WS web service endpoints with authentication configured are exposed, because the generated security constraint misses some HTTP methods. Applications without EJB JAX-WS endpoints, or without configured authentication on them, are not affected by this description. The sources do not name the exact affected product line.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ejb","java","jaxws","jboss","runtime","unknown"],"campaign_type":null,"search_a":"'-111264':15A,18A '-2026':14A,17A 'authent':7A 'cve':13A,16A 'ejb':2A 'endpoint':6A 'http':11A 'jax':4A 'jax-w':3A 'jboss':1A 'method':12A 'skip':8A 'ws':5A","search_b":"'attack':47B 'authent':38B,62B 'bypass':61B 'configur':37B 'constraint':28B 'cover':39B 'differ':57B 'ejb':19B,31B 'endpoint':35B,51B 'generat':29B 'http':42B,58B 'java':20B 'jax':22B,33B 'jax-w':21B,32B 'jboss':24B 'method':43B,59B 'reach':49B 'remot':45B 'request':54B 'runtim':25B 'secur':27B 'send':53B 'unauthent':46B 'ws':23B,34B","search_c":"'10.3.0':102C '11.0.0':104C 'anoth':92C 'attack':84C 'authent':75C,87C 'bypass':86C 'configur':74C 'constraint':65C 'ejb':68C 'endpoint':72C 'fix':107C 'generat':66C 'http':79C,93C 'issu':109C 'jax':70C 'jax-w':69C 'm2':105C 'method':80C,94C 'protect':76C 'recommend':97C 'remot':82C 'request':90C 'secur':64C 'send':89C 'unauthent':83C 'upgrad':99C 'user':95C 'version':101C 'ws':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T15:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111264","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111264","severity":null,"published_at":"2026-11-10T15:17:12+00:00","modified_at":"2026-11-10T15:17:12+00:00","first_seen_at":"2026-11-10T15:22:22+00:00","fetched_at":"2026-11-10T15:22:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}