CVE-2026-87758 · Package
NO FIX YET · SEE WHAT TO DO
The remote EJB client does not check that the server's hostname matches its TLS certificate. An attacker who can intercept traffic between client and server can impersonate the server and read or change credentials and invocation data.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use the remote EJB client to call a remote server over TLS are exposed to a man-in-the-middle attacker on the network path. Systems that do not use the remote EJB client, or that only run locally, are not affected. The sources do not name the exact product or ecosystem for this client.
Not affected if no-remote-ejb-client
Who cares ejb, java
Unknown from the sources.
10.3.0 or 11.0.0-M2, as stated in the advisory text.The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able to intercept network traffic between an EJB client and server can impersonate the server and read or modify the traffic, including credentials and invocation data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.