{"metadata": {"vulnerability": "CVE-2026-87755", "count": 11, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 5}, "linked_omitted": 0}, "data": [{"timestamp": "2026-09-09T07:01:32.622Z", "date_only": false, "value": "2026-09-09T07:01:32.622Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-87755", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-10T14:56:29.818Z", "date_only": false, "value": "2026-11-10T14:56:29.818Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-87755", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T14:56:29.818Z", "date_only": false, "value": "2026-11-10T14:56:29.818Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-87755", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-10T14:56:29.818Z", "date_only": false, "value": "2026-11-10T14:56:29.818Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "CVE-2026-87755", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-10T15:03:49.579Z", "date_only": false, "value": "2026-11-10T15:03:49.579943Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117592754027572897", "record": "CVE-2026-87755", "field": "creation_timestamp", "uuid": "f58d57dc-30c7-4ee8-bf75-9015f0d12625", "content": "CVE-2026-87755 Apache TomEE: Stateful session bean hijacking via predictable session identifiers Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other users' session state. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.\nhttps://www.cve.org/CVERecord?id=CVE-2026-87755https://lists.apache.org/thread.html/srzp26oyjtb3bwgxwsyhpphv778s17m8#ApacheSoftwareFoundation #ApacheTomEE#CVE_2026_87755#bot", "url": "https://infosec.exchange/users/cve/statuses/117592754027572897"}, {"timestamp": "2026-11-10T15:17:30Z", "date_only": false, "value": "2026-11-10T15:17:30Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-RMF6-8H3F-RGW3", "record": "GHSA-RMF6-8H3F-RGW3", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-10T15:17:30.483Z", "date_only": false, "value": "2026-11-10T15:17:30.483", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-87755", "record": "FKIE_CVE-2026-87755", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T15:17:30.483Z", "date_only": false, "value": "2026-11-10T15:17:30.483", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-87755", "record": "FKIE_CVE-2026-87755", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-10T15:33:37Z", "date_only": false, "value": "2026-11-10T15:33:37Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-RMF6-8H3F-RGW3", "record": "GHSA-RMF6-8H3F-RGW3", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T15:33:37Z", "date_only": false, "value": "2026-11-10T15:33:37Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-RMF6-8H3F-RGW3", "record": "GHSA-RMF6-8H3F-RGW3", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-10T15:56:24.274Z", "date_only": false, "value": "2026-11-10T15:56:24.274106Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/eitrutlqrasio", "record": "CVE-2026-87755", "field": "creation_timestamp", "uuid": "59c75338-6378-4725-adee-2188c59c33d7", "content": "CVE-2026-87755 - Apache TomEE: Stateful session bean hijacking via predictable session identifiers\nCVE ID : CVE-2026-87755\n \n Published : 10 Nov 2026, 2:56 p.m. | 30\u00a0minutes ago\n \n Description : Stateful session bean identifiers are not generated from a cryptographically secur...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/eitrutlqrasio"}], "metrics": {"as_of": "2026-11-10T20:38:08.302Z", "anchors": {"origin": {"timestamp": "2026-11-10T14:56:29.818Z", "date_only": false, "value": "2026-11-10T14:56:29.818Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-87755", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-10T14:56:29.818Z", "date_only": false, "value": "2026-11-10T14:56:29.818Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-87755", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 20498.484512, "hours": 5.694023475555555, "days": 0.23725097814814813, "min_seconds": 20498.484512, "max_seconds": 20498.484512, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-10T14:56:29.818Z", "date_only": false, "value": "2026-11-10T14:56:29.818Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-87755", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-10T20:38:08.302Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}