Apache Tomcat CVE-2026-68525

Exploitation requires a target application deployed on an affected Tomcat version that uses FORM-based authentication AND defines HTTP-method-specific security constraints (a constraint permitting one method such as POST while restricting another such as GET on the same resource). Applications without FORM auth, or that authorize uniformly across all methods, are not meaningfully exposed. Per CVSS (AV:N/AC:L/PR:N/UI:N) the request itself needs no prior privileges or user interaction and is remotely reachable; the real limiting factor is the presence of method-differentiated security constraints in the deployed web application's configuration.

Signals are mixed and should be weighed carefully. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) - network-reachable, low-complexity, no privileges or user interaction, with high confidentiality and integrity impact but no availability impact. CISA SSVC reinforces the technical severity (Technical Impact: total, Automatable: yes), yet records Exploitation: none, and EPSS is only 0.28% (20th percentile), so despite the high score there is currently no evidence of exploitation and no KEV listing. Practical impact is bounded by what the bypassed constraint actually protects: it enables access to a resource under a different HTTP method than authorized, which is serious for apps relying on method-level authorization but is not blanket unauthenticated takeover of arbitrary content. Net: patch on a normal-to-elevated priority track - high severity ceiling, but no active exploitation and only moderate real-world urgency today.

An attacker identifies a web application on a vulnerable Tomcat where a security constraint grants a role access to a resource under one HTTP method but denies another (e.g. POST allowed, GET denied). By crafting a request during the FORM authentication flow, the attacker reaches the resource with the disallowed method and reads or acts on data they should not be able to access. No public exploit is identified at time of analysis, and the low-complexity network vector means such a request could be issued directly against the exposed endpoint.