{"id":"CVE-2026-87756","kind":"vulnerability","aliases":["CVE-2026-87756"],"related":[],"title":"Java application server: unauthenticated remote deployment of arbitrary applications","description":"The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","summary":"Internal system EJBs used for remote deployment and configuration skip their administrative role check when the server runs with the default profile. A remote attacker who can reach the EJB endpoint can deploy arbitrary applications and execute code.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ejb","java","runtime","self-hosted"],"not_affected_if":["no-remote-ejb-endpoint","system-apps-disabled"],"how_to_check":"- Check whether the server has the system applications and a remote EJB endpoint enabled; the sources do not name the setting or file.\n- The sources do not name the product or version range, so confirm the product and version from the NVD entry.","fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, the versions the description gives; the product line is not named.","status":"open","published_at":"2026-11-10T15:17:30+00:00","first_seen_at":"2026-11-10T15:22:22+00:00","triaged_at":"2026-11-10T15:22:58+00:00","updated_at":"2026-11-10T15:22:58+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-10T15:22:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, the versions the description gives; the product line is not named.","reach":"network","title":"Java application server: unauthenticated remote deployment of arbitrary applications","impact":"high","summary":"Internal system EJBs used for remote deployment and configuration skip their administrative role check when the server runs with the default profile. A remote attacker who can reach the EJB endpoint can deploy arbitrary applications and execute code.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["java","ejb","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Remote attacker deploys applications and executes arbitrary code on server","analyst_note":"Identify the product from the NVD entry for CVE-2026-87756 and confirm the affected component and the fixed versions 10.3.0 and 11.0.0-M2 against its advisory.","how_to_check":"- Check whether the server has the system applications and a remote EJB endpoint enabled; the sources do not name the setting or file.\n- The sources do not name the product or version range, so confirm the product and version from the NVD entry.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["system-apps-disabled","no-remote-ejb-endpoint"],"who_is_affected":"Only servers that run the system applications and expose a remote EJB endpoint are exposed, according to the description. Servers that keep the remote EJB endpoint closed or leave the system applications off are not described as affected. The sources do not name the product, so the team must confirm which installs run it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.001416,"input_tokens":4587,"output_tokens":1914,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-87756':12A,15A '10.3.0':124C '11.0.0':126C 'abl':89C 'administr':33B,74C 'applic':2A,9A,56B,99C,109C 'arbitrari':8A,55B,98C 'attack':46B,88C 'check':35B,76C 'code':59B,102C 'configur':30B,69C 'could':96C 'cve':10A,13A 'default':42B,83C 'deploy':6A,28B,54B,67C,97C 'ejb':16B,24B,51B,63C,94C,113C 'enabl':106C 'endpoint':52B,95C,114C 'enforc':72C 'execut':58B,101C 'expos':116C 'fix':129C 'host':21B 'instal':104C 'intern':22B,61C 'issu':131C 'java':1A,17B 'm2':127C 'profil':43B,84C 'ran':80C 'reach':49B,91C 'recommend':119C 'remot':5A,27B,45B,66C,86C,93C,112C 'role':34B,75C 'run':39B 'runtim':18B 'self':20B 'self-host':19B 'server':3A,38B,79C 'skip':31B 'system':23B,62C,108C 'unauthent':4A,87C 'upgrad':121C 'use':25B,64C 'user':117C 'version':123C","nicknames":[],"mitigations":[],"who_affected":"Only servers that run the system applications and expose a remote EJB endpoint are exposed, according to the description. Servers that keep the remote EJB endpoint closed or leave the system applications off are not described as affected. The sources do not name the product, so the team must confirm which installs run it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","ejb","java","runtime","selfhosted"],"campaign_type":null,"search_a":"'-2026':11A,14A '-87756':12A,15A 'applic':2A,9A 'arbitrari':8A 'cve':10A,13A 'deploy':6A 'java':1A 'remot':5A 'server':3A 'unauthent':4A","search_b":"'administr':33B 'applic':56B 'arbitrari':55B 'attack':46B 'check':35B 'code':59B 'configur':30B 'default':42B 'deploy':28B,54B 'ejb':16B,24B,51B 'endpoint':52B 'execut':58B 'host':21B 'intern':22B 'java':17B 'profil':43B 'reach':49B 'remot':27B,45B 'role':34B 'run':39B 'runtim':18B 'self':20B 'self-host':19B 'server':38B 'skip':31B 'system':23B 'use':25B","search_c":"'10.3.0':124C '11.0.0':126C 'abl':89C 'administr':74C 'applic':99C,109C 'arbitrari':98C 'attack':88C 'check':76C 'code':102C 'configur':69C 'could':96C 'default':83C 'deploy':67C,97C 'ejb':63C,94C,113C 'enabl':106C 'endpoint':95C,114C 'enforc':72C 'execut':101C 'expos':116C 'fix':129C 'instal':104C 'intern':61C 'issu':131C 'm2':127C 'profil':84C 'ran':80C 'reach':91C 'recommend':119C 'remot':66C,86C,93C,112C 'role':75C 'server':79C 'system':62C,108C 'unauthent':87C 'upgrad':121C 'use':64C 'user':117C 'version':123C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T15:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87756","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87756","severity":null,"published_at":"2026-11-10T15:17:30+00:00","modified_at":"2026-11-10T15:17:30+00:00","first_seen_at":"2026-11-10T15:22:22+00:00","fetched_at":"2026-11-10T15:22:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}