UNKNOWNCVSS not yet scoredVulnerability
CVE-2026-86811
The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Properties
- Last source
- NVD
- Nvd fetched at
- 2026-11-10T23:33:48.924589+00:00
- Cve id
- CVE-2026-86811
- First seen by Signal
- 2026-11-10T15:26:48+00:00
- Retrieved at
- 2026-11-10T23:34:23+00:00
- Published at
- 2026-11-10T15:17:30.193
- Last modified
- 2026-11-10T15:17:30.193
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph