CVE-2026-111239 Apache TomEE: Code execution by any authenticated user via the SSH administration shell

The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role. An attacker holding the credentials of any user in that domain, including a low-privileged...

CVE-2026-111239

The Apache TomEE optional SSH administration service is vulnerable to unauthorized code execution because it fails to verify administrative roles. Any user capable of authenticating against the configured login domain—including low-privileged application users —can gain full access to the adminis...