CVE-2026-87756 · Runtime
NO FIX YET · SEE WHAT TO DO
Internal system EJBs used for remote deployment and configuration skip their administrative role check when the server runs with the default profile. A remote attacker who can reach the EJB endpoint can deploy arbitrary applications and execute code.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only servers that run the system applications and expose a remote EJB endpoint are exposed, according to the description. Servers that keep the remote EJB endpoint closed or leave the system applications off are not described as affected. The sources do not name the product, so the team must confirm which installs run it.
Not affected if no-remote-ejb-endpoint, system-apps-disabled
Who cares ejb, java, self-hosted
10.3.0 or 11.0.0-M2, the versions the description gives; the product line is not named.The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.