---
id: "CVE-2026-87758"
page: "https://infrastack.ai/live/CVE-2026-87758"
kind: "vulnerability"
aliases: ["CVE-2026-87758"]
title: "Remote EJB client skips TLS hostname check, allowing server impersonation"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ejb", "java", "package"]
not_affected_if: ["no-remote-ejb-client"]
published_at: "2026-11-10T16:17:24+00:00"
first_seen_at: "2026-11-10T16:22:35+00:00"
updated_at: "2026-11-10T16:23:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87758", "first_seen_at": "2026-11-10T16:22:35+00:00"}]
exploit_sources: []
---

# Remote EJB client skips TLS hostname check, allowing server impersonation

Link for people: https://infrastack.ai/live/CVE-2026-87758 (this .md is for agents)

The remote EJB client does not check that the server's hostname matches its TLS certificate. An attacker who can intercept traffic between client and server can impersonate the server and read or change credentials and invocation data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

- Upgrade to `10.3.0` or `11.0.0-M2`, as stated in the advisory text.

## Timeline

- 2026-11-10T16:22:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87758

## From the sources

The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able to intercept network traffic between an EJB client and server can impersonate the server and read or modify the traffic, including credentials and invocation data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_