Quick answers
- Is CVE-2026-111246 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-111246 being exploited in the wild.
- How severe is CVE-2026-111246?
- Informational severity, published 10 November 2026.
- Which products and versions are affected?
- Apache OpenEJB.
- Is there a fix for CVE-2026-111246?
- No fixed version is recorded yet. Block network access to the embedded OpenEJB HTTP server from untrusted clients, or migrate to TomEE distributions which use Tomcat as the web container. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-111246 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-111246?
- Check whether you run Apache OpenEJB. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Block network access to the embedded OpenEJB HTTP server from untrusted clients, or migrate to TomEE distributions which use Tomcat as the web container.
Technical details
The OpenEJB embedded HTTP server fails to enforce session isolation between co-hosted web applications, allowing a remote attacker to reuse an authenticated session across application boundaries. The vulnerability requires network access to the embedded HTTP server and affects only deployments hosting multiple web applications on the same embedded server instance. An attacker can escalate privileges or bypass authentication within a target application by leveraging a valid session from another application.
Affected products
- Apache OpenEJB
Timeline
- 2026-11-10: disclosed