Apache Tomcat CVE-2026-43512

Exploitation requires that the target Tomcat web application be configured to use HTTP DIGEST authentication (login-config auth-method DIGEST) to protect one or more resources - this is the specific, non-default feature that must be enabled; instances using BASIC, FORM, client-certificate, or no container-managed authentication are not exposed to this bypass. Where DIGEST auth is in use, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity are needed, so any network-reachable attacker can attempt it. The principal limiting factors are therefore the DIGEST-auth configuration prerequisite (uncommon in practice), network reachability of the protected endpoints, and the affected version ranges; there is no public POC and no confirmed active exploitation to lower the practical barrier.

The signals conflict sharply and should temper the headline 9.8. The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) and the SSVC framing (Automatable: yes, Technical Impact: total) argue for high priority, since an auth bypass reachable over the network with no privileges and no user interaction is inherently dangerous. Against that, SSVC records Exploitation: none, there is no CISA KEV entry, no public POC is identified, and EPSS is extremely low at 0.04% / 12th percentile, indicating the community does not currently expect exploitation in the wild. Critically, the CVE is explicitly marked DEPRECATED, which undermines confidence in the record's current validity and scoring. A key limiting factor not captured by the CVSS score is that DIGEST authentication is a non-default, relatively rarely-used configuration in Tomcat deployments, so real-world exposure is far narrower than an unauthenticated 9.8 implies. Net assessment: patch as part of normal maintenance, but this is a high-CVSS/low-current-real-risk issue rather than an emergency, and the DEPRECATED status warrants verifying the record with the vendor before acting on the numeric severity.

An attacker targets a Tomcat instance whose web application protects a sensitive area (such as an admin or API path) using HTTP DIGEST authentication. Because the vector is network-based with low complexity and no privileges or user interaction required, the attacker sends specially crafted requests that defeat the digest challenge-response check and are accepted as authenticated, gaining access to the protected resources. No public exploit code is identified at time of analysis, so this scenario is inferred from the CVSS vector and the CWE-592 auth-bypass class rather than a demonstrated POC.