CVE-2026-87755
— UNSCOREDPublished 2026-11-10 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other users' session state. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Weaknesses
CWE-340
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- UNSCOREDCVE-2026-107242
- MEDIUMCVE-2026-118527
- MEDIUMCVE-2026-46346PoC
- MEDIUMCVE-2026-46347PoC
- MEDIUMCVE-2026-79980PoC
- UNSCOREDCVE-2026-85297PoC
- HIGHCVE-2026-85496PoC
- HIGHCVE-2026-95653PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.