{"id":"CVE-2026-87758","kind":"vulnerability","aliases":["CVE-2026-87758"],"related":[],"title":"Remote EJB client skips TLS hostname check, allowing server impersonation","description":"The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able to intercept network traffic between an EJB client and server can impersonate the server and read or modify the traffic, including credentials and invocation data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","summary":"The remote EJB client does not check that the server's hostname matches its TLS certificate. An attacker who can intercept traffic between client and server can impersonate the server and read or change credentials and invocation data.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ejb","java","package"],"not_affected_if":["no-remote-ejb-client"],"how_to_check":null,"fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, as stated in the advisory text.","status":"open","published_at":"2026-11-10T16:17:24+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","triaged_at":"2026-11-10T16:23:58+00:00","updated_at":"2026-11-10T16:23:58+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-10T16:23:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, as stated in the advisory text.","reach":"network","title":"Remote EJB client skips TLS hostname check, allowing server impersonation","impact":"high","summary":"The remote EJB client does not check that the server's hostname matches its TLS certificate. An attacker who can intercept traffic between client and server can impersonate the server and read or change credentials and invocation data.","audience":"developers","category":"package","nicknames":[],"who_cares":["ejb","java"],"confidence":0.5,"fix_status":"available","needs_auth":"no","worst_case":"attacker reads and modifies EJB traffic, including credentials","analyst_note":"Confirm the affected product and artifact (likely WildFly or JBoss remote EJB client) and its vulnerable ranges from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-87758.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-remote-ejb-client"],"who_is_affected":"Applications that use the remote EJB client to call a remote server over TLS are exposed to a man-in-the-middle attacker on the network path. Systems that do not use the remote EJB client, or that only run locally, are not affected. The sources do not name the exact product or ecosystem for this client.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000711,"input_tokens":4561,"output_tokens":510,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-87758':13A,16A '10.3.0':115C '11.0.0':117C 'abl':82C 'allow':8A 'attack':37B,81C 'certif':35B,79C 'chang':53B 'check':7A,26B 'client':3A,23B,43B,61C,90C 'connect':72C 'credenti':54B,104C 'cve':11A,14A 'data':57B,107C 'ejb':2A,17B,22B,60C,89C 'fix':120C 'hostnam':6A,31B,67C 'imperson':10A,47B,94C 'includ':103C 'intercept':40B,84C 'invoc':56B,106C 'issu':122C 'java':18B 'm2':118C 'match':32B,74C 'modifi':100C 'network':85C 'packag':19B 'read':51B,98C 'recommend':110C 'remot':1A,21B,59C 'server':9A,29B,45B,49B,70C,76C,92C,96C 'skip':4A 'tls':5A,34B,78C 'traffic':41B,86C,102C 'upgrad':112C 'user':108C 'verifi':64C 'version':114C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the remote EJB client to call a remote server over TLS are exposed to a man-in-the-middle attacker on the network path. Systems that do not use the remote EJB client, or that only run locally, are not affected. The sources do not name the exact product or ecosystem for this client.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ejb","java","package","unknown"],"campaign_type":null,"search_a":"'-2026':12A,15A '-87758':13A,16A 'allow':8A 'check':7A 'client':3A 'cve':11A,14A 'ejb':2A 'hostnam':6A 'imperson':10A 'remot':1A 'server':9A 'skip':4A 'tls':5A","search_b":"'attack':37B 'certif':35B 'chang':53B 'check':26B 'client':23B,43B 'credenti':54B 'data':57B 'ejb':17B,22B 'hostnam':31B 'imperson':47B 'intercept':40B 'invoc':56B 'java':18B 'match':32B 'packag':19B 'read':51B 'remot':21B 'server':29B,45B,49B 'tls':34B 'traffic':41B","search_c":"'10.3.0':115C '11.0.0':117C 'abl':82C 'attack':81C 'certif':79C 'client':61C,90C 'connect':72C 'credenti':104C 'data':107C 'ejb':60C,89C 'fix':120C 'hostnam':67C 'imperson':94C 'includ':103C 'intercept':84C 'invoc':106C 'issu':122C 'm2':118C 'match':74C 'modifi':100C 'network':85C 'read':98C 'recommend':110C 'remot':59C 'server':70C,76C,92C,96C 'tls':78C 'traffic':86C,102C 'upgrad':112C 'user':108C 'verifi':64C 'version':114C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87758","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87758","severity":null,"published_at":"2026-11-10T16:17:24+00:00","modified_at":"2026-11-10T16:17:24+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","fetched_at":"2026-11-10T16:22:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}