Apache Tomcat CVE-2026-59083

Exploitation requires the target Tomcat instance to have the RewriteValve configured AND to rely on Tomcat security constraints (web.xml <security-constraint> URL patterns) to protect resources - this is the 'for some configurations' precondition stated in the advisory, not a default out-of-the-box posture. When those conditions are met, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a remote, unauthenticated, low-complexity request with no user interaction is sufficient. The primary limiting factor is the non-default configuration dependency: deployments that do not use the RewriteValve, or that do not enforce access control via URL-pattern security constraints, are not exposed. Impact is confined to confidentiality and integrity of the improperly protected resources (A:N - no availability impact).

The signals are mixed and require judgment. CVSS is 9.1 Critical with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - network reachable, low complexity, no authentication, high confidentiality and integrity impact, no availability impact - which taken alone reads as an urgent, mass-exploitable flaw. However, the description explicitly scopes it to 'some configurations,' specifically deployments that use the RewriteValve in combination with security constraints; the CVSS vector does not model this configuration precondition, so real-world exposure is narrower than the 9.1 suggests. There is no KEV listing (not confirmed actively exploited), no POC referenced in the provided data (no public exploit identified at time of analysis), and no EPSS score was supplied, so exploitation probability cannot be quantified from the input. SSVC framing would likely be: Exploitation=none-observed, Automatable=yes (constraint bypass is scriptable once a vulnerable config is found), Technical Impact=total for the protected resources. Net: this is a genuine high-priority patch for organizations that run the RewriteValve to enforce access control, but for the large fraction of Tomcat deployments that do not use the rewrite valve for security constraints the practical risk is materially lower than the headline score. Verify your own tomcat configuration (presence of RewriteValve + security-constraint) to determine actual exposure.

An attacker profiles an internet-facing Tomcat application that uses the RewriteValve and protects an administrative or internal path with a URL-pattern security constraint. They send a normal HTTP request whose path uses hex-encoded characters (e.g. percent-encoded dots or slashes) so the rewrite valve's normalization diverges from the constraint matcher, causing the security constraint to not match while the resource is still served. With no authentication required (PR:N) and low complexity, the attacker retrieves or manipulates the protected resource; no public POC was referenced in the provided data.