CVE-2026-87756

{
  "etk_id": "ETK-2026-4064",
  "cve_id": "CVE-2026-87756",
  "display_id": "CVE-2026-87756",
  "ghsa_id": "GHSA-52g3-qw9c-qp2m",
  "euvd_id": "EUVD-2026-121216",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing authorization in Apache TomEE remote deployment",
  "summary": "Apache TomEE installations using the default profile may expose internal deployment and configuration EJBs without the required administrative authorization check. An unauthenticated remote attacker who can reach an enabled remote EJB endpoint may deploy applications and execute code. Systems without enabled system applications or a remotely exposed EJB endpoint are not affected by the stated condition.",
  "mitigation": "Upgrade org.apache.tomee:openejb-core to a fixed release: 10.0.0-M1, 10.3.0, or 11.0.0-M2. Until upgraded, disable system applications or prevent untrusted networks from reaching the remote EJB endpoint.",
  "vendor": "Apache Software Foundation",
  "product": "Apache TomEE",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.5.1, <= 4.7.5"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "org.apache.openejb:openejb-core",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 7.0.0-M1, < 10.0.0-M1",
        ">= 10.0.0-M1, < 10.3.0",
        ">= 11.0.0-M1, < 11.0.0-M2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "10.0.0-M1",
        "10.3.0",
        "11.0.0-M2"
      ],
      "package_name": "org.apache.tomee:openejb-core",
      "purl": null
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 28.933492816666668,
  "t0_at": "2026-11-10T14:57:19.763000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-10T14:57:19.763000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-10T14:57:19.763000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87756"
    }
  }
}