{"id":"CVE-2026-87755","kind":"vulnerability","aliases":["CVE-2026-87755"],"related":[],"title":"EJB container: stateful session IDs guessable, enabling other clients' bean access","description":"Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other users' session state. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","summary":"Stateful session bean identifiers are generated from a non-cryptographic random source, so they can be predicted. An attacker with access to the EJB remote endpoint and one valid identifier can derive other clients' identifiers and invoke methods on their beans, reading or changing their session state.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ejb","java","runtime","stateful-session-beans"],"not_affected_if":["no-remote-ejb-endpoint","stateless-beans-only"],"how_to_check":null,"fix":"- Product not named in the sources; fixed versions are `10.3.0` or `11.0.0-M2`","status":"open","published_at":"2026-11-10T15:17:30+00:00","first_seen_at":"2026-11-10T15:22:22+00:00","triaged_at":"2026-11-10T15:22:56+00:00","updated_at":"2026-11-10T15:22:56+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-10T15:22:56Z","model":"claude-haiku-5-5","output":{"fix":"- Product not named in the sources; fixed versions are `10.3.0` or `11.0.0-M2`","reach":"network","title":"EJB container: stateful session IDs guessable, enabling other clients' bean access","impact":"medium","summary":"Stateful session bean identifiers are generated from a non-cryptographic random source, so they can be predicted. An attacker with access to the EJB remote endpoint and one valid identifier can derive other clients' identifiers and invoke methods on their beans, reading or changing their session state.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ejb","java","stateful-session-beans"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads or changes other users' session state and invokes their beans","analyst_note":"","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-remote-ejb-endpoint","stateless-beans-only"],"who_is_affected":"Applications that expose stateful session beans through an EJB remote endpoint are exposed, because the attacker needs to reach that endpoint. Applications that do not expose a remote EJB endpoint, or that only use stateless beans, are not described as affected by the sources. The sources do not name the product, so the team should confirm which EJB container they run.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001264,"input_tokens":4563,"output_tokens":1615,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-87755':14A,17A '10.3.0':128C '11.0.0':130C 'access':11A,46B,90C 'attack':44B,88C 'bean':10A,24B,27B,66B,75C,113C 'chang':69B 'client':9A,59B,106C 'contain':2A 'cryptograph':35B,82C 'cve':12A,15A 'deriv':57B,102C 'ejb':1A,18B,49B,93C 'enabl':7A 'endpoint':51B,95C 'expos':114C 'fix':133C 'generat':30B,79C 'guessabl':6A 'hold':97C 'id':5A 'identifi':28B,55B,60B,76C,100C 'invok':62B,109C 'issu':135C 'java':19B 'm2':131C 'method':63B,110C 'modifi':116C 'non':34B 'non-cryptograph':33B 'one':53B,98C 'predict':42B 'random':36B,84C 'read':67B 'recommend':123C 'remot':50B,87C,94C 'runtim':20B 'secur':83C 'session':4A,23B,26B,71B,74C,107C,119C 'sourc':37B,85C 'state':3A,22B,25B,72B,73C,120C 'stateful-session-bean':21B 'upgrad':125C 'user':118C,121C 'valid':54B,99C 'version':127C","nicknames":[],"mitigations":[],"who_affected":"Applications that expose stateful session beans through an EJB remote endpoint are exposed, because the attacker needs to reach that endpoint. Applications that do not expose a remote EJB endpoint, or that only use stateless beans, are not described as affected by the sources. The sources do not name the product, so the team should confirm which EJB container they run.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ejb","java","runtime","statefulsessionbeans","unknown"],"campaign_type":null,"search_a":"'-2026':13A,16A '-87755':14A,17A 'access':11A 'bean':10A 'client':9A 'contain':2A 'cve':12A,15A 'ejb':1A 'enabl':7A 'guessabl':6A 'id':5A 'session':4A 'state':3A","search_b":"'access':46B 'attack':44B 'bean':24B,27B,66B 'chang':69B 'client':59B 'cryptograph':35B 'deriv':57B 'ejb':18B,49B 'endpoint':51B 'generat':30B 'identifi':28B,55B,60B 'invok':62B 'java':19B 'method':63B 'non':34B 'non-cryptograph':33B 'one':53B 'predict':42B 'random':36B 'read':67B 'remot':50B 'runtim':20B 'session':23B,26B,71B 'sourc':37B 'state':22B,25B,72B 'stateful-session-bean':21B 'valid':54B","search_c":"'10.3.0':128C '11.0.0':130C 'access':90C 'attack':88C 'bean':75C,113C 'client':106C 'cryptograph':82C 'deriv':102C 'ejb':93C 'endpoint':95C 'expos':114C 'fix':133C 'generat':79C 'hold':97C 'identifi':76C,100C 'invok':109C 'issu':135C 'm2':131C 'method':110C 'modifi':116C 'one':98C 'random':84C 'recommend':123C 'remot':87C,94C 'secur':83C 'session':74C,107C,119C 'sourc':85C 'state':73C,120C 'upgrad':125C 'user':118C,121C 'valid':99C 'version':127C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T15:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87755","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87755","severity":null,"published_at":"2026-11-10T15:17:30+00:00","modified_at":"2026-11-10T15:17:30+00:00","first_seen_at":"2026-11-10T15:22:22+00:00","fetched_at":"2026-11-10T15:22:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}