PT-2026-141785

CVE-2026-97849

·

Published

2026-11-10

·

Updated

2026-11-10

Description by

Score
N/A
Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Researchers
Vendors
Affected products
Weakness enumeration
CWE-1327: Binding to an Unrestricted IP Address
Related identifiers
CVE-2026-97849
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com