PT-2026-141741

CVE-2026-111263

·

Published

2026-11-10

·

Updated

2026-11-10

Description by

Score
N/A
Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application. A remote unauthenticated attacker can invoke the web service operations, unless the application protects the endpoint with its own web.xml security constraints or EJB method permissions. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-306: Missing Authentication for Critical Function
Related identifiers
CVE-2026-111263
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com