CVE-2026-111263: Apache TomEE: missing auth on EJB JAX-WS endpoints

AWAITING NVD

Published November 10, 2026

CISO Take

Apache TomEE does not enforce the authentication configured in its deployment descriptor for EJB JAX-WS web service endpoints published inside an existing web application. A remote, unauthenticated attacker can call those operations unless the application adds its own web.xml security constraints or EJB method permissions. The record has no severity score, no EPSS data, no KEV listing, no public exploit and no Nuclei template, so there is no evidence of active exploitation. The link to AI/ML is also weak: TomEE is a general-purpose Java application server, and it matters to AI programs only where it hosts ML-facing SOAP services or data pipelines. Upgrade to TomEE 10.3.0 or 11.0.0-M2, then inventory JAX-WS endpoints that rely only on descriptor-based authentication and confirm they have container-level constraints.

Sources:NVDATLASlists.apache.org

What is the risk?

Risk is moderate to high for exposed TomEE deployments, but there is no formal score. The weakness is CWE-306 (missing authentication for a critical function), the attack needs no credentials and is remote, and exploitation is likely low-complexity. Exposure depends on whether a JAX-WS endpoint is published and relies only on descriptor-based authentication. There is no EPSS score, KEV listing, public exploit or scanner template, so current exploitation likelihood is unknown and probably low. Applications that already set web.xml constraints or EJB method permissions are not affected. The impact is limited to the operations the endpoint exposes.

How does the attack unfold?

Reconnaissance

The attacker locates TomEE-hosted SOAP endpoints and retrieves their WSDL.

AML.T0006

Initial Access

The attacker calls the JAX-WS endpoint without credentials because the descriptor-based authentication is not enforced.

AML.T0049

Impact

The attacker invokes exposed operations to read data or alter inputs to the ML service behind the endpoint.

Reconnaissance

The attacker locates TomEE-hosted SOAP endpoints and retrieves their WSDL.

AML.T0006

Initial Access

The attacker calls the JAX-WS endpoint without credentials because the descriptor-based authentication is not enforced.

AML.T0049

Impact

The attacker invokes exposed operations to read data or alter inputs to the ML service behind the endpoint.

How severe is it?

CVSS 3.1

N/A

EPSS

0.2%

chance of exploitation in 30 days

Higher than 15% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Upgrade TomEE to 10.3.0 or 11.0.0-M2. 2) Until patched, add explicit security constraints in web.xml for the JAX-WS endpoint URL patterns, or add EJB method permissions (@RolesAllowed) on the service beans. 3) Inventory all TomEE-hosted SOAP endpoints and confirm each requires authentication when called anonymously. 4) Restrict network exposure of these endpoints with a reverse proxy, WAF or IP allowlist. 5) Monitor access logs for unauthenticated calls to SOAP endpoints and for unexpected WSDL or operation requests. 6) Review the Apache advisory thread for further detail.

How is it classified?

Auth BypassAPIFrameworkAML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responding to unknown or newly identified risks

Frequently Asked Questions

What is CVE-2026-111263?

Is CVE-2026-111263 actively exploited?

No confirmed active exploitation of CVE-2026-111263 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-111263?

1) Upgrade TomEE to 10.3.0 or 11.0.0-M2. 2) Until patched, add explicit security constraints in web.xml for the JAX-WS endpoint URL patterns, or add EJB method permissions (@RolesAllowed) on the service beans. 3) Inventory all TomEE-hosted SOAP endpoints and confirm each requires authentication when called anonymously. 4) Restrict network exposure of these endpoints with a reverse proxy, WAF or IP allowlist. 5) Monitor access logs for unauthenticated calls to SOAP endpoints and for unexpected WSDL or operation requests. 6) Review the Apache advisory thread for further detail.

What systems are affected by CVE-2026-111263?

This vulnerability affects the following AI/ML architecture patterns: Java-based model serving gateways, SOAP/JAX-WS service wrappers for ML services, Data ingestion pipelines.

What is the CVSS score for CVE-2026-111263?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

Java-based model serving gatewaysSOAP/JAX-WS service wrappers for ML servicesData ingestion pipelines

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application. A remote unauthenticated attacker can invoke the web service operations, unless the application protects the endpoint with its own web.xml security constraints or EJB method permissions. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Exploitation Scenario

An attacker finds a TomEE-hosted internal service that wraps a model-scoring or data-ingestion function as an EJB JAX-WS endpoint, for example by fetching its WSDL. The team configured authentication only in the TomEE deployment descriptor, so the endpoint is open without credentials. The attacker sends crafted SOAP requests to invoke operations anonymously, retrieving prediction results or metadata, or submitting data into the downstream ML pipeline.

Weaknesses (CWE)

CWE-306Missing Authentication for Critical FunctionalityPrimary CWE-306Missing Authentication for Critical Functionality

CWE-306 — Missing Authentication for Critical Functionality: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.