CVE-2026-97874: vulnerability in Apache TomEE
Apache TomEE: Authentication bypass for Hessian endpoints in non-root web applications
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.2%
When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol.
Affected products
Apache Software Foundation · Apache TomEERelated CVEs — Apache TomEE
In the same product, most dangerous first.
CVE-2018-8031—CVE-2018-8031EPSS 2.0%CVE-2026-111264—Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP methodEPSS 0.3%CVE-2026-111263—Apache TomEE: Missing authentication on EJB web service endpoints deployed in a web applicationEPSS 0.2%CVE-2026-111242—Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identityEPSS 0.2%CVE-2026-111250—Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP serverEPSS 0.2%CVE-2026-97880—Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authenticationEPSS 0.2%