---
id: "CVE-2026-87755"
page: "https://infrastack.ai/live/CVE-2026-87755"
kind: "vulnerability"
aliases: ["CVE-2026-87755"]
title: "EJB container: stateful session IDs guessable, enabling other clients' bean access"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ejb", "java", "runtime", "stateful-session-beans"]
not_affected_if: ["no-remote-ejb-endpoint", "stateless-beans-only"]
published_at: "2026-11-10T15:17:30+00:00"
first_seen_at: "2026-11-10T15:22:22+00:00"
updated_at: "2026-11-10T15:22:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87755", "first_seen_at": "2026-11-10T15:22:22+00:00"}]
exploit_sources: []
---

# EJB container: stateful session IDs guessable, enabling other clients' bean access

Link for people: https://infrastack.ai/live/CVE-2026-87755 (this .md is for agents)

Stateful session bean identifiers are generated from a non-cryptographic random source, so they can be predicted. An attacker with access to the EJB remote endpoint and one valid identifier can derive other clients' identifiers and invoke methods on their beans, reading or changing their session state.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

- Product not named in the sources; fixed versions are `10.3.0` or `11.0.0-M2`

## Timeline

- 2026-11-10T15:22:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87755

## From the sources

Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other users' session state. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_