---
id: "CVE-2026-86336"
page: "https://infrastack.ai/live/CVE-2026-86336"
kind: "vulnerability"
aliases: ["CVE-2026-86336"]
title: "Apache TomEE on JDK 21+ skips EJB method authorization checks"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Apache TomEE", "fixed": [], "affected": "", "ecosystem": "runtime"}]
ecosystems: ["runtime"]
tags: ["apache-tomee", "ejb", "java", "jdk21", "runtime"]
not_affected_if: ["jdk-below-21", "no-ejb-authorization"]
published_at: "2026-11-10T16:17:24+00:00"
first_seen_at: "2026-11-10T16:22:35+00:00"
updated_at: "2026-11-10T16:24:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86336", "first_seen_at": "2026-11-10T16:22:35+00:00"}]
exploit_sources: []
---

# Apache TomEE on JDK 21+ skips EJB method authorization checks

Link for people: https://infrastack.ai/live/CVE-2026-86336 (this .md is for agents)

Apache TomEE running on JDK 21 or later does not enforce configured access restrictions on EJB methods. A caller can invoke EJB methods that should be off limits to them.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- runtime:Apache TomEE affected range not listed fixed no fixed version listed

## How to check

- Check the TomEE version in use and whether the runtime JDK is 21 or later (`java -version`).
- Review EJB method permission settings (for example `@RolesAllowed`, `@DenyAll` or `ejb-jar.xml` security constraints) to see which methods depend on them.

## Fix

- Apache TomEE: upgrade to `10.3.0` or `11.0.0-M2`, per the description.

## Timeline

- 2026-11-10T16:22:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86336

## From the sources

Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_