CVE-2026-111246
Apache TomEE: HTTP sessions shared across web applications in embedded HTTP server
Description
The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a session established in one web application in another one, which then trusts session state set by the first application. Only deployments hosting several web applications on the embedded HTTP server are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
INFO
Published Date :
Nov. 10, 2026, 3:23 p.m.
Last Modified :
Nov. 10, 2026, 3:23 p.m.
Remotely Exploit :
No
Source :
apache
Solution
- Block network access to the embedded HTTP server.
- Migrate to TomEE distributions.
- Configure session isolation for web applications.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-111246 vulnerability anywhere in the article.