Skip to main content

Apache Tomcat CVE-2026-59084

| EUVDEUVD-2026-43640 CRITICAL
Insufficient Technical Documentation (CWE-1059)
2026-07-14 apache GHSA-cwxf-7cw2-7r32
Apache Information Disclosure Red Hat Tomcat Suse Apache Tomcat Apache Software Foundation
Critical
Disputed · 9.1 Vendor: apache
View

Vulnerability Assessment

Weakness
CWE
CWE-1059
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Jul 14, 2026

Cluster-communication confidentiality and integrity in Apache Tomcat can be undermined because the secure-configuration requirements for the EncryptInterceptor were never clearly documented, leaving operators liable to deploy the cluster session-replication channel insecurely. The flaw affects Tomcat 7.0.100-7.0.109, 8.5.38-8.5.100, 9.0.13-9.0.119, 10.1.0-M1-10.1.56 and 11.0.0-M1-11.0.23, and is fixed in 9.0.120, 10.1.57 and 11.0.24. It carries a CVSS 9.1 (C:H/I:H) but SSVC records exploitation as none, no public exploit identified at time of analysis, and the root cause is a documentation weakness (CWE-1059) rather than a code defect.

Earlier versions of this analysis (1)
v1 Jul 14, 2026 - 09:31

Insufficient documentation of EncryptInterceptor security configuration requirements in Apache Tomcat exposes clustered deployments to potential interception of inter-node cluster traffic. Across Tomcat versions 7.0.x through 11.0.x, the requirements needed to securely deploy the EncryptInterceptor component were not clearly communicated, meaning administrators following existing guidance may have deployed it in an insecure state without awareness of the gap. No public exploit is identified at time of analysis, and this is a documentation/misconfiguration class issue rather than a traditional code vulnerability; however, the resulting exposure of cluster communications in affected deployments represents a tangible confidentiality and integrity risk.

Affected VersionsENISA

Apache Tomcat 7.0.100 ≤7.0.109
Apache Tomcat 9.0.13 ≤9.0.119
Apache Tomcat 8.5.38 ≤8.5.100
Apache Tomcat 10.1.0-M1 ≤10.1.56
Apache Tomcat 11.0.0-M1 ≤11.0.23

Affected Packages

euvd apache_tomcat no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Apache Tomcat gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
Vendor (apache) PRIMARY 9.1 LOW
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI 5.9 MEDIUM

Adjacent network vector for cluster traffic; AC:H because misconfiguration from undocumented requirements must be present; no confidentiality or integrity impact on availability.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE 7.3 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Red Hat 3.8 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

3
Severity Changed
Jul 14, 2026 - 15:22 NVD
LOW CRITICAL
CVSS changed
Jul 14, 2026 - 15:22 NVD
9.1 (LOW) 9.1 (CRITICAL)
CVE Published
Jul 14, 2026 - 08:24 cve.org
LOW

DescriptionCVE.org

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.

Articles & Coverage 2

News 3 New Apache Vulnerabilities - 2 Critical, 1 High Severity Jul 15, 2026 News Critical Cluster Communication Vulnerability in Apache Tomcat - CVE-2026-59084 Jul 14, 2026

Executive ViewAI

Why It Matters

Apache Tomcat versions 7.0.100-11.0.23 can lose encryption and integrity protection on cluster session-replication channels due to unclear configuration documentation, risking exposure of session data in transit between servers. Organizations with clustered Tomcat deployments may unknowingly be transmitting sensitive session information in cleartext, creating surveillance and tampering exposure in multi-server architectures.

Recommended Action

Within 24 hours, determine if your infrastructure uses Apache Tomcat in cluster mode with session replication; if not deployed in this configuration, document and close. If clustering is in use, within 7 days audit the EncryptInterceptor configuration to verify session-replication channels are encrypted and integrity-protected per vendor guidance, and schedule upgrades to patched versions (9.0.120, 10.1.57, or 11.0.24 depending on your current release branch). Within 30 days, complete patches for all affected clustered Tomcat instances, validate configuration aligns with security documentation, and test failover to confirm secure session replication.

Business Impact: High
Compensating Controls

If immediate patching is not feasible, enforce EncryptInterceptor configuration to explicitly enable encryption and message authentication on all cluster-communication channels; validate using network monitoring to confirm encrypted session-replication traffic. Upgrade to patched Tomcat versions (9.0.120, 10.1.57, or 11.0.24) as soon as operationally feasible.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Social Media
2
Sightings
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Total

Priority Score

20
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +20
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Apache Tomcat

View all
CVE-2026-34486 HIGH POC
7.5 Apr 09

Missing encryption of cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 exposes sensitive sessi
CVE-2026-29146 HIGH POC
7.5 Apr 09

Padding oracle attack in Apache Tomcat EncryptInterceptor leaks encrypted session data confidentiality across versions 7
CVE-2026-50229 MEDIUM POC
6.1 Jun 29

Reflected XSS in Apache Tomcat's bundled 'number guess' example application exposes users of that demo page to script in
CVE-2026-76183 CRITICAL
9.8 Sep 23

Authentication bypass in Apache Tomcat allows unauthenticated remote attackers to reach WebSocket endpoints that are sup
CVE-2026-43512 CRITICAL
9.8 May 12

Authentication bypass in Apache Tomcat's DIGEST authentication implementation allows remote attackers to circumvent HTTP
CVE-2026-41293 CRITICAL
9.8 May 12

Improper input validation in Apache Tomcat (CWE-20) affects a broad range of releases across the 8.5, 9.0, 10.0, 10.1, a
CVE-2026-29145 CRITICAL
9.1 Apr 09

Authentication bypass in Apache Tomcat 9.x through 11.x and Tomcat Native 1.1.23-2.0.13 allows unauthenticated remote at
CVE-2026-43515 CRITICAL
9.1 May 12

Authorization bypass in Apache Tomcat (versions 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.117, 10.1.0-M1-10.1.54, and 1
CVE-2026-86350 CRITICAL
9.1 Sep 23

HTTP/2 request smuggling in Apache Tomcat can mix up request headers between concurrent streams, allowing unauthenticate
CVE-2026-43513 HIGH
7.5 May 12

Information disclosure in Apache Tomcat's LockOutRealm component allows remote attackers to bypass account-lockout track
CVE-2026-41284 HIGH
7.5 May 12

Denial of service in Apache Tomcat 9.x, 10.1.x, and 11.0.x allows remote unauthenticated attackers to exhaust server res
CVE-2026-34487 HIGH
7.5 Apr 09

Apache Tomcat's cloud membership clustering component logs Kubernetes bearer tokens in plaintext, enabling unauthenticat

Same weakness CWE-1059 – Insufficient Technical Documentation

View all
CVE-2022-3270 CRITICAL
9.8
CVE-2026-48035 HIGH
7.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:36872 ADVISORY https://access.redhat.com/errata/RHSA-2026:37767 ADVISORY https://lists.apache.org/thread/7w9746ootcxo0gvx26xjpw80l31f1qw7 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-59084 ADVISORY https://seclists.org/oss-sec/2026/q3/138 ADVISORY https://vuldb.com/vuln/378272 REF http://www.openwall.com/lists/oss-security/2026/07/14/8

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy