Apache Tomcat CVE-2026-74049

Exploitation requires an application running on an affected Tomcat version (11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, 9.0.0.M1 through 9.0.122, or EOL 8.5.0-8.5.100 / 7.0.0-7.0.109) that relies on an HTTP redirect to enforce an access-control or flow-control decision; the Execution After Redirect flaw means request processing continues past the redirect, so the exposure exists wherever application or container code issues a redirect but does not terminate the request. The concrete prerequisite the attacker needs is a reachable endpoint whose security depends on that redirect halting execution. LIMITING FACTORS: the input provides no CVSS vector, so authentication requirements are not confirmed from available data; realistic impact is limited to information disclosure (no integrity or availability impact indicated), and deployments already on the fixed releases (11.0.27 / 10.1.61 / 9.0.123) are not exposed.

No CVSS vector, EPSS score, or SSVC data was provided for CVE-2026-74049, so quantitative risk signals are entirely absent and must be inferred from the CWE and description. The flaw is an Execution After Redirect (CWE-698) weakness in Apache Tomcat, and the vendor-supplied 'Information Disclosure' tag indicates the practical impact is unauthorized read access to data/resources that should have been gated behind the redirect, rather than code execution or integrity loss. There is no CISA KEV listing and no POC referenced in the input, so exploitation status is 'no public exploit identified at time of analysis' - this is not currently a confirmed active-exploitation priority. That said, EAR bugs in Tomcat are typically network-reachable and often require no authentication, and Tomcat's enormous deployment footprint means a widely-applicable information-disclosure flaw warrants prompt patching even without an EPSS/KEV signal. Net assessment: likely a moderate-severity, low-complexity disclosure issue rather than a critical RCE, but the complete absence of a scored CVSS vector means severity is inferred and should be verified against the Apache advisory. CONFLICT/GAP: CVSS is 'N/A' in the input, so attack vector, complexity, and privilege requirements cannot be confirmed - treat the assessed vector below as analyst-derived, not vendor-confirmed.

A remote attacker sends a crafted HTTP request to a Tomcat-hosted application endpoint that performs an access-control check and issues a redirect but continues processing the request afterward. Because execution does not halt at the redirect, the server still generates and returns the protected response body or resource data, disclosing information the redirect was meant to withhold. No public exploit code is referenced in the available data, so this scenario is based on the CWE-698 pattern rather than a confirmed POC.