{"id":"CVE-2026-86336","kind":"vulnerability","aliases":["CVE-2026-86336"],"related":[],"title":"Apache TomEE on JDK 21+ skips EJB method authorization checks","description":"Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","summary":"Apache TomEE running on JDK 21 or later does not enforce configured access restrictions on EJB methods. A caller can invoke EJB methods that should be off limits to them.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Apache TomEE","fixed":[],"affected":"","ecosystem":"runtime"}],"ecosystems":["runtime"],"tags":["apache-tomee","ejb","java","jdk21","runtime"],"not_affected_if":["jdk-below-21","no-ejb-authorization"],"how_to_check":"- Check the TomEE version in use and whether the runtime JDK is 21 or later (`java -version`).\n- Review EJB method permission settings (for example `@RolesAllowed`, `@DenyAll` or `ejb-jar.xml` security constraints) to see which methods depend on them.","fix":"- Apache TomEE: upgrade to `10.3.0` or `11.0.0-M2`, per the description.","status":"open","published_at":"2026-11-10T16:17:24+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","triaged_at":"2026-11-10T16:24:02+00:00","updated_at":"2026-11-10T16:24:02+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-10T16:24:02Z","model":"claude-haiku-5-5","output":{"fix":"- Apache TomEE: upgrade to `10.3.0` or `11.0.0-M2`, per the description.","reach":"unknown","title":"Apache TomEE on JDK 21+ skips EJB method authorization checks","impact":"medium","summary":"Apache TomEE running on JDK 21 or later does not enforce configured access restrictions on EJB methods. A caller can invoke EJB methods that should be off limits to them.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-tomee","java","jdk21","ejb"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Callers invoke restricted EJB methods without authorization checks","analyst_note":"Confirm the affected version range and attack reach from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-86336 and any Apache TomEE security advisory.","how_to_check":"- Check the TomEE version in use and whether the runtime JDK is 21 or later (`java -version`).\n- Review EJB method permission settings (for example `@RolesAllowed`, `@DenyAll` or `ejb-jar.xml` security constraints) to see which methods depend on them.","plain_action":"","product_name":"Apache TomEE","needs_analyst":true,"not_affected_if":["jdk-below-21","no-ejb-authorization"],"who_is_affected":"Applications deployed on Apache TomEE running on JDK 21 or later that rely on EJB method-level access restrictions are exposed. Deployments on older JDKs, or apps that do not use EJB security restrictions, are less likely to be affected. The sources do not say which callers can reach the EJB methods over the network.","user_interaction":"no","product_ecosystem":"runtime","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000781,"input_tokens":4545,"output_tokens":652,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-86336':13A,16A '10.3.0':87C '11.0.0':89C '21':5A,31B,59C 'access':38B,76C 'allow':67C 'apach':1A,20B,26B,54C 'apache':17A 'apache-tome':19B 'author':9A,65C 'caller':44B,68C 'check':10A,66C 'configur':37B,75C 'cve':11A,14A 'ejb':7A,22B,41B,47B,63C,71C 'enforc':36B,79C 'fix':92C 'invok':46B,70C 'issu':94C 'java':23B 'jdk':4A,30B,58C 'jdk21':24B 'later':33B,61C 'limit':53B 'm2':90C 'method':8A,42B,48B,64C,72C 'recommend':82C 'restrict':39B,77C 'run':28B,56C 'runtim':25B 'skip':6A,62C 'tome':2A,21B,27B,55C 'tomee':18A 'upgrad':84C 'user':80C 'version':86C 'without':73C","nicknames":[],"mitigations":[],"who_affected":"Applications deployed on Apache TomEE running on JDK 21 or later that rely on EJB method-level access restrictions are exposed. Deployments on older JDKs, or apps that do not use EJB security restrictions, are less likely to be affected. The sources do not say which callers can reach the EJB methods over the network.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apachetomee","tomee"],"ptokens":["apache","tomee"],"labels":["apachetomee","ejb","java","jdk21","runtime","unknown"],"campaign_type":null,"search_a":"'-2026':12A,15A '-86336':13A,16A '21':5A 'apach':1A 'apache':17A 'author':9A 'check':10A 'cve':11A,14A 'ejb':7A 'jdk':4A 'method':8A 'skip':6A 'tome':2A 'tomee':18A","search_b":"'21':31B 'access':38B 'apach':20B,26B 'apache-tome':19B 'caller':44B 'configur':37B 'ejb':22B,41B,47B 'enforc':36B 'invok':46B 'java':23B 'jdk':30B 'jdk21':24B 'later':33B 'limit':53B 'method':42B,48B 'restrict':39B 'run':28B 'runtim':25B 'tome':21B,27B","search_c":"'10.3.0':87C '11.0.0':89C '21':59C 'access':76C 'allow':67C 'apach':54C 'author':65C 'caller':68C 'check':66C 'configur':75C 'ejb':63C,71C 'enforc':79C 'fix':92C 'invok':70C 'issu':94C 'jdk':58C 'later':61C 'm2':90C 'method':64C,72C 'recommend':82C 'restrict':77C 'run':56C 'skip':62C 'tome':55C 'upgrad':84C 'user':80C 'version':86C 'without':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86336","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86336","severity":null,"published_at":"2026-11-10T16:17:24+00:00","modified_at":"2026-11-10T16:17:24+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","fetched_at":"2026-11-10T16:22:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}