Apache Tomcat CVE-2026-41293

The available advisory does not name a specific feature, connector, or configuration setting that must be enabled, so the precise prerequisite cannot be confirmed from the input data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) implies remote, unauthenticated reachability without user interaction against an exposed Tomcat connector. Limiting factors: exploitation requires network reachability to a vulnerable Tomcat listener; the true impact may be limited to information disclosure (per tags) rather than full compromise; and the exact affected component is undisclosed, meaning some deployments may not expose the vulnerable code path. Verify the required conditions against the Apache advisory before making risk decisions.

The signals here diverge sharply and should not be treated as a uniform 'critical'. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) and SSVC 'Technical Impact: total' with 'Automatable: yes' argue for high severity if the vulnerability is genuinely remotely reachable with full impact. However, EPSS is 0.04% (11th percentile) - extremely low - SSVC 'Exploitation: none', no POC, and no CISA KEV listing all indicate there is currently no observed or expected exploitation. Additionally, the 'Information Disclosure' tag conflicts with the CVSS I:H/A:H claim, suggesting the real-world impact may be limited to confidentiality rather than full compromise - verify the true impact with the Apache advisory before treating this as an RCE-class issue. Net assessment: patch on a normal-to-prompt cycle because Tomcat is internet-facing and widely deployed, but the current data does not support emergency out-of-band response.

A remote attacker sends specially crafted input (e.g., a malformed HTTP request or header) to an internet-reachable Tomcat instance to trigger the improper input validation and, per the CVSS vector, potentially reach sensitive data or affect server processing. The low attack complexity (AC:L) and lack of required privileges or user interaction mean the request could be delivered directly against a default listener, though no public proof-of-concept exists to confirm reliability.