WhatBrokeToday
FAQ
Today's Trends
criticalInvestigatingApachevJDK 21 or later

Apache TomEE on JDK 21+ Skips EJB Method Authorization Checks

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

Apache TomEE running on JDK 21 or later suffers from a critical vulnerability where EJB method authorization checks are skipped, allowing callers to invoke EJB methods without enforced access restrictions. Users are advised to upgrade to version 10.3.0 or 11.0.0-M2.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix
Technical root cause

Under active investigation. No report has identified a root cause yet.

Evidence

1 report · 1 CVEShow
  1. [1]
    CVE First report
    Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods wi: CVE-2026-86336 (Critical)(opens security advisory in a new tab)

    Critical severity. Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

    by Tenable 0upvotes 0comments

Timeline

  1. First report on security advisory

    Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods wi: CVE-2026-86336 (Critical)

    Source