CVE-2026-87758
Description
The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able to intercept network traffic between an EJB client and server can impersonate the server and read or modify the traffic, including credentials and invocation data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Is your site exposed to CVE-2026-87758?
Run a free security scan — no signup, results in seconds.
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
References
Other References
Frequently Asked Questions
What is CVE-2026-87758? +
How do I check if I'm vulnerable to CVE-2026-87758? +
Related Vulnerabilities
Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not …
Allow attackers to intercept or falsify data exchanges between the client and the server
SumatraPDF is a multi-format reader for Windows. In version 3.6.1 and earlier, HttpGet() in src/base/Http_win.cpp unconditionally passes INTERNET_FLAG_IGNORE_CERT_CN_INVALID to WinINet, …
Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary in the middle to impersonate a …
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior …
Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured …
