CVE-2026-111264: EJB JAX-WS endpoints: auth bypass via alternate HTTP method

AWAITING NVD

Published November 10, 2026

CISO Take

A Java application server flaw lets a remote, unauthenticated attacker bypass authentication on EJB JAX-WS endpoints. The generated security constraint covers only some HTTP methods, so sending a request with a different method skips the check (CWE-288). No CVSS score, EPSS data, CISA KEV listing, public exploit or Nuclei template is available yet, so exploitation likelihood cannot be quantified. The AI/ML link is indirect and unconfirmed: no affected AI package is listed and the package risk score is 0/100. It matters only if you expose ML-serving or data-pipeline SOAP endpoints on this server. Upgrade to version 10.3.0 or 11.0.0-M2 and audit any internet-facing JAX-WS services for unauthenticated access.

Sources:NVDATLASlists.apache.org

What is the risk?

Severity is not yet scored. The weakness class is an authentication bypass over the network with no credentials, which is typically high impact for exposed endpoints. There is no known exploitation, EPSS score, KEV listing, public exploit or scanner template. AI/ML exposure is limited to deployments that put JAX-WS endpoints in front of AI services or data. Overall risk for AI/ML systems is low to moderate and depends on whether the vulnerable endpoints are internet-facing.

How does the attack unfold?

Initial Access

The attacker identifies an exposed EJB JAX-WS endpoint that has authentication configured.

AML.T0049

Exploitation

The attacker sends a request with an HTTP method not covered by the generated security constraint and skips authentication.

Impact

The attacker invokes protected service operations or reads data behind the endpoint, which may include AI/ML-related data or functions.

Initial Access

The attacker identifies an exposed EJB JAX-WS endpoint that has authentication configured.

AML.T0049

Exploitation

The attacker sends a request with an HTTP method not covered by the generated security constraint and skips authentication.

Impact

The attacker invokes protected service operations or reads data behind the endpoint, which may include AI/ML-related data or functions.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Upgrade to version 10.3.0 or 11.0.0-M2, as recommended in the Apache advisory. 2) Until patched, put a reverse proxy or WAF in front of the endpoints that enforces authentication and allows only the HTTP methods the service needs (typically POST). 3) Inventory EJB JAX-WS endpoints that have authentication configured. Test whether unauthenticated requests using other methods (GET, PUT, HEAD, OPTIONS) reach the service. 4) Review access logs for unauthenticated non-POST requests to SOAP endpoints. 5) Restrict network exposure of these services to trusted segments.

How is it classified?

Auth BypassAPIFrameworkAML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and manage third-party component risks

Frequently Asked Questions

What is CVE-2026-111264?

Is CVE-2026-111264 actively exploited?

No confirmed active exploitation of CVE-2026-111264 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-111264?

1) Upgrade to version 10.3.0 or 11.0.0-M2, as recommended in the Apache advisory. 2) Until patched, put a reverse proxy or WAF in front of the endpoints that enforces authentication and allows only the HTTP methods the service needs (typically POST). 3) Inventory EJB JAX-WS endpoints that have authentication configured. Test whether unauthenticated requests using other methods (GET, PUT, HEAD, OPTIONS) reach the service. 4) Review access logs for unauthenticated non-POST requests to SOAP endpoints. 5) Restrict network exposure of these services to trusted segments.

What systems are affected by CVE-2026-111264?

This vulnerability affects the following AI/ML architecture patterns: SOAP/JAX-WS service gateways, Enterprise model-serving integrations, Data ingestion pipelines.

What is the CVSS score for CVE-2026-111264?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

SOAP/JAX-WS service gatewaysEnterprise model-serving integrationsData ingestion pipelines

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Exploitation Scenario

An attacker finds a JAX-WS endpoint of an application server that fronts an internal ML scoring or data-preparation service. A normal request returns 401 because authentication is configured. The attacker repeats the request with a different HTTP method that the generated security constraint does not cover. The endpoint processes it without authentication, so the attacker can invoke operations or read data that should have been protected.

Weaknesses (CWE)

CWE-288Authentication Bypass Using an Alternate Path or ChannelPrimary CWE-288Authentication Bypass Using an Alternate Path or Channel

CWE-288 — Authentication Bypass Using an Alternate Path or Channel: The product requires authentication, but the product has an alternate path or channel that does not require authentication.

[Architecture and Design] Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

Source: MITRE CWE corpus.