CVE-2026-97874: falha em Apache TomEE
Apache TomEE: Authentication bypass for Hessian endpoints in non-root web applications
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.2%
When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol.
Produtos afetados
Apache Software Foundation · Apache TomEECVEs relacionadas — Apache TomEE
No mesmo produto, das mais perigosas para as menos.
CVE-2018-8031—CVE-2018-8031EPSS 2.0%CVE-2026-111264—Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP methodEPSS 0.3%CVE-2026-111263—Apache TomEE: Missing authentication on EJB web service endpoints deployed in a web applicationEPSS 0.2%CVE-2026-111242—Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identityEPSS 0.2%CVE-2026-111250—Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP serverEPSS 0.2%CVE-2026-97880—Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authenticationEPSS 0.2%