CVE-2026-87755

Not scored yetLast modified Nov 12, 2026

Description

Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other users' session state. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-340

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 12, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-87756The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran wiCVE-2026-87758The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able CVE-2026-877598.8The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membershCVE-2026-87768.8A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function formPPTPSetup of the file /goform/formPPTPSCVE-2026-877608.8The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visCVE-2026-877618.0The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticCVE-2026-877628.8The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, anCVE-2026-877648.8The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is CVE-2026-877655.5In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of CVE-2026-877668.8A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the CVE-2026-877678.6The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQCVE-2026-877687.5DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds. _normalize_leap_seconds crosses
CVE-2026-87755: Unscored | Vulnix