VulnTideExploited vulnerabilities, by vendor. Data as of .
Not in CISA KEVPublished EPSS 0.1% probability of exploitation in 30 daysFound by AI: Anthropic (Claude)
Apache

CVE-2026-97867: Apache TomEE: Database credential disclosure via remote JNDI lookup

Is it exploited?

Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of . If CISA adds it, this page shows it as known exploited.

How likely is exploitation in the next 30 days?
0.1%

EPSS score, percentile 2.9 of all scored records. A probability estimated by FIRST, not a report of exploitation.

How severe?
Not scored

The CVE record carries no CVSS score.

What should I do?

CISA has set no required action, because the vulnerability is not in KEV.

Advisories and patches (1)

Which versions are affected?

Affected

  • 4.0.0-beta-1 through 4.7.5
  • from 7.0.0-M1 to before 10.0.0-M1
  • from 10.0.0-M1 to before 10.3.0
  • from 11.0.0-M1 to before 11.0.0-M2

Versions by product

Source: CISA KEV 2026.11.10, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.

Description

Apache TomEE: Database credential disclosure via remote JNDI lookup

The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to the database directly. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Source: CVE List, as of . About the data.

What to do

Advisories and patches

This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.

Affected products and versions

Versions by product, as listed in the CVE record (2 products)
Apache Software Foundation Apache TomEE
StatusVersions
Affected4.0.0-beta-1 through 4.7.5

Versions not listed are: unaffected.

Apache Software Foundation Apache TomEE
StatusVersions
Affectedfrom 7.0.0-M1 to before 10.0.0-M1
Affectedfrom 10.0.0-M1 to before 10.3.0
Affectedfrom 11.0.0-M1 to before 11.0.0-M2

Versions not listed are: unaffected.

Source: CVE List, as of . About the data.

Weakness

CWE-522
  • CWE-522: Insufficiently Protected Credentials

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.

Timeline

DateEvent
CVE record published

Known exploited Apache vulnerabilities

  • CVE-2016-3081: Apache Struts Command Injection Vulnerability (added )
  • CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability (added )
  • CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability (added )
  • CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability (added )
  • CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability (added )