Apache
CVE-2026-86811: The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with ac
CVE-2026-86811 Nov 10, 2026 Source: Vendor
The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-86811
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
1 line
Showing 1–1 of 1
CVE-2026-86811
BR2026-0000-044221
unclaimed
Credited as The Apache Software Foundation