CVE-2026-87755 · Runtime
NO FIX YET · SEE WHAT TO DO
Stateful session bean identifiers are generated from a non-cryptographic random source, so they can be predicted. An attacker with access to the EJB remote endpoint and one valid identifier can derive other clients' identifiers and invoke methods on their beans, reading or changing their session state.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that expose stateful session beans through an EJB remote endpoint are exposed, because the attacker needs to reach that endpoint. Applications that do not expose a remote EJB endpoint, or that only use stateless beans, are not described as affected by the sources. The sources do not name the product, so the team should confirm which EJB container they run.
Not affected if no-remote-ejb-endpoint, stateless-beans-only
Who cares ejb, java, stateful-session-beans
Unknown from the sources.
10.3.0 or 11.0.0-M2Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other users' session state. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.