# CVE-2026-87755: Enterprise Java Beans session identifier weak randomness

Source: https://junglewise.ai/threats/cve-2026-87755-stateful-session-bean-identifiers-are-not-generated-from-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-87755 · Severity: info · Published 2026-11-10

A Java application server that uses Enterprise Java Beans for stateful sessions generates session identifiers using a non-cryptographic random source. An attacker with access to the EJB remote interface who obtains one valid session identifier can predict identifiers of other user sessions and gain unauthorized access to or modify other users' business data and application state.

Vendors: [Unknown](https://junglewise.ai/threats/vendors/unknown).

## Quick answers

**Is CVE-2026-87755 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87755 being exploited in the wild.

**How severe is CVE-2026-87755?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** Unknown Enterprise Java Beans prior to 10.3.0 and 11.0.0-M2.

**Is there a fix for CVE-2026-87755?** Yes: fixed in 10.3.0, 11.0.0-M2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-87755 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-87755?** Check whether you run Unknown Enterprise Java Beans at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 10.3.0, 11.0.0-M2

## Technical details

Stateful session bean identifiers in this component are generated using a weak pseudo-random number generator rather than a cryptographically secure source. A remote attacker who can access the EJB remote endpoint and possesses one valid session identifier can derive and predict the identifiers of concurrent client sessions. This allows the attacker to invoke arbitrary methods on other users' stateful session beans, exposing or modifying their session state.

## Affected products

- <UNKNOWN> Enterprise Java Beans prior to 10.3.0 and 11.0.0-M2

## Timeline

- 2026-11-10: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread.html/srzp26oyjtb3bwgxwsyhpphv778s17m8](https://lists.apache.org/thread.html/srzp26oyjtb3bwgxwsyhpphv778s17m8)