{"metadata": {"vulnerability": "CVE-2026-87756", "count": 11, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 5}, "linked_omitted": 0}, "data": [{"timestamp": "2026-09-09T07:08:03.642Z", "date_only": false, "value": "2026-09-09T07:08:03.642Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-87756", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-10T14:57:19.763Z", "date_only": false, "value": "2026-11-10T14:57:19.763Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-87756", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T14:57:19.763Z", "date_only": false, "value": "2026-11-10T14:57:19.763Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-87756", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-10T14:57:19.763Z", "date_only": false, "value": "2026-11-10T14:57:19.763Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "CVE-2026-87756", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-10T15:06:29.723Z", "date_only": false, "value": "2026-11-10T15:06:29.723574Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117592764533043963", "record": "CVE-2026-87756", "field": "creation_timestamp", "uuid": "05be0e19-32a0-4aa9-9539-e0209859c4a4", "content": "CVE-2026-87756 Apache TomEE: Missing authorization on internal deployer EJBs in default profile The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.\nhttps://www.cve.org/CVERecord?id=CVE-2026-87756https://lists.apache.org/thread.html/4748mnztpzyfcy840z143ttgj92yl84r#ApacheSoftwareFoundation #ApacheTomEE#CVE_2026_87756#bot", "url": "https://infosec.exchange/users/cve/statuses/117592764533043963"}, {"timestamp": "2026-11-10T15:17:30Z", "date_only": false, "value": "2026-11-10T15:17:30Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-52G3-QW9C-QP2M", "record": "GHSA-52G3-QW9C-QP2M", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-10T15:17:30.603Z", "date_only": false, "value": "2026-11-10T15:17:30.603", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-87756", "record": "FKIE_CVE-2026-87756", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T15:17:30.603Z", "date_only": false, "value": "2026-11-10T15:17:30.603", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-87756", "record": "FKIE_CVE-2026-87756", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-10T15:33:37Z", "date_only": false, "value": "2026-11-10T15:33:37Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-52G3-QW9C-QP2M", "record": "GHSA-52G3-QW9C-QP2M", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T15:33:37Z", "date_only": false, "value": "2026-11-10T15:33:37Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-52G3-QW9C-QP2M", "record": "GHSA-52G3-QW9C-QP2M", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-10T16:08:24.208Z", "date_only": false, "value": "2026-11-10T16:08:24.208378Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/g4ljlwn4bromr", "record": "CVE-2026-87756", "field": "creation_timestamp", "uuid": "8054ea6f-f5da-4af5-8ac8-5f7762cd7aa4", "content": "CVE-2026-87756 - Apache TomEE: Missing authorization on internal deployer EJBs in default profile\nCVE ID : CVE-2026-87756\n \n Published : 10 Nov 2026, 2:57 p.m. | 29\u00a0minutes ago\n \n Description : The internal system EJBs used for remote deployment and configuration did not enfor...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/g4ljlwn4bromr"}], "metrics": {"as_of": "2026-11-11T21:19:22.093Z", "anchors": {"origin": {"timestamp": "2026-11-10T14:57:19.763Z", "date_only": false, "value": "2026-11-10T14:57:19.763Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-87756", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-10T14:57:19.763Z", "date_only": false, "value": "2026-11-10T14:57:19.763Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-87756", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 109322.330775, "hours": 30.367314104166667, "days": 1.2653047543402778, "min_seconds": 109322.330775, "max_seconds": 109322.330775, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-10T14:57:19.763Z", "date_only": false, "value": "2026-11-10T14:57:19.763Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-87756", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T21:19:22.093Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}