CVE-2026-87756
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 10, 2026
Vendor
unknown
Description
The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.