CVE-2026-111264: vulnerability in Apache TomEE
Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP method
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.3%
The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Affected products
Apache Software Foundation · Apache TomEERelated CVEs — Apache TomEE
In the same product, most dangerous first.
CVE-2018-8031—CVE-2018-8031EPSS 2.0%CVE-2026-111263—Apache TomEE: Missing authentication on EJB web service endpoints deployed in a web applicationEPSS 0.2%CVE-2026-111242—Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identityEPSS 0.2%CVE-2026-111250—Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP serverEPSS 0.2%CVE-2026-97880—Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authenticationEPSS 0.2%CVE-2026-111245—Apache TomEE: Privilege escalation via WS-Security caller identity leaking between requestsEPSS 0.2%