CVE-2026-86336

Not scored yetLast modified Nov 12, 2026

Description

Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 12, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-863386.0Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced iCVE-2026-86349.1Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromCVE-2026-863414.4GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that,CVE-2026-863424.3Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlatioCVE-2026-863436.8An improper neutralization of CRLF sequences vulnerability in the SNMP API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.CVE-2026-863447.5A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incCVE-2026-863459.0A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StarCVE-2026-863476.5Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry for templates/uploaCVE-2026-863484.3Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash CVE-2026-863494.3Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit the nesting depth in the server-CVE-2026-86359.9IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, CVE-2026-863509.1Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in
CVE-2026-86336: Unscored | Vulnix