{"api_version":"1","generated_at":"2026-11-14T05:03:33+00:00","cve":"CVE-2026-111239","urls":{"html":"https://cve.report/CVE-2026-111239","api":"https://cve.report/api/cve/CVE-2026-111239.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-111239","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-111239"},"summary":{"title":"Apache TomEE: Code execution by any authenticated user via the SSH administration shell","description":"The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role. An attacker holding the credentials of any user in that domain, including a low-privileged application user, can execute arbitrary code as the server process. Users are recommended to disable the SSH administration service, or to block network access to it from untrusted clients and restrict its login domain to administrative users.","state":"PUBLISHED","assigner":"apache","published_at":"2026-11-10 16:17:14","updated_at":"2026-11-12 17:06:26"},"problem_types":["CWE-862","CWE-862 CWE-862 Missing Authorization"],"metrics":[],"references":[{"url":"https://lists.apache.org/thread/wfoxj510yol03lmzbzdftyphwvtq87wg","name":"https://lists.apache.org/thread/wfoxj510yol03lmzbzdftyphwvtq87wg","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-111239","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111239","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 4.0.0 4.7.5 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 7.0.0-M1 10.0.0-M1 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 10.0.0-M1 10.2.0 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 11.0.0-M1 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 4.0.0 4.7.5 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 7.0.0-M1 10.0.0-M1 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 10.0.0-M1 10.2.0 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 11.0.0-M1 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"The Apache Software Foundation","lang":"en"},{"source":"CNA","value":"Claude Security","lang":"en"},{"source":"CNA","value":"Richard Zowalla","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"111239","cve":"CVE-2026-111239","epss":"0.001950000","percentile":"0.093560000","score_date":"2026-11-12","updated_at":"2026-11-13 00:14:37"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-111239","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:56:16.551793Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-11T10:51:11.015Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-ssh","packageURL":"pkg:maven/org.apache.openejb/openejb-ssh","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-ssh","packageURL":"pkg:maven/org.apache.tomee/openejb-ssh","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-common-cli","packageURL":"pkg:maven/org.apache.openejb/openejb-common-cli","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-common-cli","packageURL":"pkg:maven/org.apache.tomee/openejb-common-cli","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"The Apache Software Foundation"},{"lang":"en","type":"tool","value":"Claude Security"},{"lang":"en","type":"remediation developer","value":"Richard Zowalla"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role. An attacker holding the credentials of any user in that domain, including a low-privileged application user, can execute arbitrary code as the server process. Users are recommended to disable the SSH administration service, or to block network access to it from untrusted clients and restrict its login domain to administrative users."}],"value":"The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role. An attacker holding the credentials of any user in that domain, including a low-privileged application user, can execute arbitrary code as the server process. Users are recommended to disable the SSH administration service, or to block network access to it from untrusted clients and restrict its login domain to administrative users."}],"metrics":[{"other":{"content":{"text":"moderate"},"type":"Textual description of severity"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-10T15:30:57.925Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/wfoxj510yol03lmzbzdftyphwvtq87wg"}],"source":{"discovery":"INTERNAL"},"title":"Apache TomEE: Code execution by any authenticated user via the SSH administration shell","x_generator":{"engine":"Vulnogram 1.0.3"}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2026-111239","datePublished":"2026-11-10T15:30:57.925Z","dateReserved":"2026-10-15T18:35:58.969Z","dateUpdated":"2026-11-11T10:51:11.015Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-10 16:17:14","lastModifiedDate":"2026-11-12 17:06:26","problem_types":["CWE-862","CWE-862 CWE-862 Missing Authorization"],"metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-11T04:56:16.551793Z","id":"CVE-2026-111239","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"111239","Ordinal":"1","Title":"Apache TomEE: Code execution by any authenticated user via the S","CVE":"CVE-2026-111239","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"111239","Ordinal":"1","NoteData":"The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role. An attacker holding the credentials of any user in that domain, including a low-privileged application user, can execute arbitrary code as the server process. Users are recommended to disable the SSH administration service, or to block network access to it from untrusted clients and restrict its login domain to administrative users.","Type":"Description","Title":"Apache TomEE: Code execution by any authenticated user via the S"}]}}}