Quick answers
- Is CVE-2026-97870 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-97870 being exploited in the wild.
- How severe is CVE-2026-97870?
- Informational severity, published 10 November 2026.
- Which products and versions are affected?
- Apache Geronimo.
- Is there a fix for CVE-2026-97870?
- No fixed version is recorded yet. Block network access to Hessian endpoints from untrusted clients, or migrate to a different remoting protocol that is not subject to this configuration bypass. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-97870 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-97870?
- Check whether you run Apache Geronimo. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Block network access to Hessian endpoints from untrusted clients, or migrate to a different remoting protocol that is not subject to this configuration bypass.
Technical details
Hessian remoting endpoints served by Geronimo's embedded HTTP server fail to enforce configured authentication and transport security (TLS) requirements. The vulnerability allows remote unauthenticated access to exposed EJB methods via network-based Hessian protocol invocation, bypassing intended security constraints. The advisory does not indicate a published patch exists.
Affected products
- Apache Geronimo
Timeline
- 2026-11-10: disclosed