Is CVE-2026-111242 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111242 being exploited in the wild.

How severe is CVE-2026-111242?

Informational severity, published 10 November 2026.

Which products and versions are affected?

Apache Geronimo versions prior to 10.3.0 and 11.0.0-M2.

Is there a fix for CVE-2026-111242?

Yes: fixed in Geronimo 10.3.0, 11.0.0-M2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111242 attacked?

It is attacked over the network.

Am I affected by CVE-2026-111242?

Check whether you run Apache Geronimo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111242: Apache Geronimo MicroProfile JWT authentication security state leak

CVE-2026-111242 · Severity: info · Published 2026-11-10

Apache Geronimo, a Java application server, uses MicroProfile JWT for authentication in servlets with elevated privileges (run-as identity). When requests fail to complete normally, the authentication state is not properly cleared from the processing thread. An attacker with a valid JWT token can exploit this to cause subsequent unrelated requests to run with elevated privileges, potentially accessing or modifying protected resources.

Technologies: Apache Geronimo. Vendors: Apache.

Quick answers

Is CVE-2026-111242 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111242 being exploited in the wild.
How severe is CVE-2026-111242?: Informational severity, published 10 November 2026.
Which products and versions are affected?: Apache Geronimo versions prior to 10.3.0 and 11.0.0-M2.
Is there a fix for CVE-2026-111242?: Yes: fixed in Geronimo 10.3.0, 11.0.0-M2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111242 attacked?: It is attacked over the network.
Am I affected by CVE-2026-111242?: Check whether you run Apache Geronimo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Geronimo 10.3.0, 11.0.0-M2

Technical details

A security state cleanup flaw in Apache Geronimo's MicroProfile JWT authentication mechanism fails to clear the established security context when servlets with run-as identity declarations do not complete normally. An authenticated remote attacker can trigger abnormal request termination and then send subsequent requests on the same thread, which will inherit the elevated run-as identity and execute enterprise bean methods with those privileges. This is a thread-local state pollution vulnerability that affects authentication and authorization enforcement.

Affected products

Apache Geronimo versions prior to 10.3.0 and 11.0.0-M2

Timeline

2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.