Apache Tomcat CVE-2026-73180

Exploitation requires three concurrent conditions to be met: (1) the attacker holds an authenticated HTTP session on the target Tomcat instance - PR:L per the supplied CVSS vector confirms authentication is required; (2) a WebSocket connection has been established and is active under that authenticated HTTP session prior to the attack; and (3) the HTTP session ID is changed or rotated - whether driven by application security logic (post-login session fixation defenses, privilege change workflows) or by attacker-influenced mechanisms. Exploitation is impossible against unauthenticated connections, against sessions where no WebSocket upgrade has occurred, or against applications that never perform session ID rotation. The high attack complexity (AC:H) in the CVSS vector captures the requirement that the attacker must coordinate WebSocket establishment and session ID rotation in the correct sequence, which is non-trivial to engineer reliably in arbitrary targets.

The 6.8 CVSS score accurately reflects moderate-to-high severity with constrained exploitation difficulty: the network vector (AV:N) and high confidentiality/integrity impact (C:H/I:H) are balanced by high attack complexity (AC:H) and low-privilege requirements (PR:L), meaning an attacker must already hold authenticated access and orchestrate a specific session ID rotation event while a WebSocket connection is simultaneously active. The EPSS score of 0.28% at the 19th percentile strongly indicates this vulnerability is not being exploited broadly or opportunistically - there is no CISA KEV listing to contradict this low signal. The most counterintuitive risk factor is that the triggering condition (session ID rotation) is a security best practice actively encouraged in secure SDLC guidance; applications that implement post-login session rotation or privilege-level session changes are therefore more exposed than those that do not rotate IDs at all. Organizations running Tomcat with WebSocket endpoints and session-rotating application logic - such as multi-tenant SaaS platforms or authenticated streaming applications - should treat this as a meaningful operational risk despite the low EPSS, while those with no WebSocket usage have no exposure.

An attacker with a valid authenticated session on a Tomcat-hosted application establishes a WebSocket connection, then triggers a session ID rotation - either through an application-level workflow such as a privilege escalation, re-authentication step, or an explicitly coded post-login session rotation - causing the original HTTP session to be invalidated. The WebSocket connection, which Tomcat fails to close as required by the specification, remains open and usable, allowing the attacker to continue interacting with the application endpoint over the persistent WebSocket channel beyond the intended session boundary. No public proof-of-concept exploit has been identified at time of analysis.