CVE-2026-111241

Not scored yetLast modified Nov 12, 2026

Description

When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared system temporary directory, reusing files that already exist there, and is deserialized on activation. A local attacker who can write to that directory can read passivated session state or supply data that the server deserializes, potentially leading to code execution as the server process. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-377

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Apache Software Foundation	Apache TomEE	>= 4.0.0-beta-1, <= 4.7.5
Apache Software Foundation	Apache TomEE	>= 7.0.0-M1, < 10.0.0-M1; >= 10.0.0-M1, < 10.3.0; >= 11.0.0-M1, < 11.0.0-M2

References

https://lists.apache.org/thread/kbpc7t241483pnxo2sccrhyp6pjkwbq2

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-111242When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is no CVE-2026-111243A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. CVE-2026-111244When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: res CVE-2026-111245After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request co CVE-2026-111246The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a session established in CVE-2026-111247When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the role CVE-2026-111248The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text an CVE-2026-111249The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any CVE-2026-111258.8Use after free in Compositing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox v CVE-2026-111250The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remo CVE-2026-111251The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or process able to conne CVE-2026-1112526.5A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without