Apache Tomcat Native EUVD-2026-85270

Requires a Tomcat deployment using the Apache Tomcat Native library (the APR/OpenSSL-based TLS connector) AND configured to require client certificate verification (mutual TLS) - only 'some configurations' are affected per the advisory. Exploitation is limited by the CWE-366 race condition (AC:H): the attacker must win a narrow, non-deterministic timing window across concurrent threads, so success is probabilistic rather than guaranteed. Deployments not using Tomcat Native, or not enforcing client-certificate authentication, are not exposed. No authentication or user interaction is required to attempt the race (PR:N/UI:N).

The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, base 7.4, HIGH) describes a network-reachable, unauthenticated flaw with high attack complexity - the AC:H reflects the CWE-366 race condition, which an attacker must win a narrow timing window to exploit reliably. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so all three exploitation signals are absent; per precision rules this is 'no public exploit identified at time of analysis.' SSVC decision inputs (exploitation, automatable, technical impact) were not supplied. The realistic risk is moderate rather than urgent: exploitation is probabilistic (race window) and only affects deployments that actually use the optional APR/OpenSSL connector with client-certificate (mTLS) verification, so this is a genuine-but-conditional issue, not a broadly wormable one. Note the input Tags label this 'Information Disclosure,' but the vector carries I:H and the effect is a mutual-TLS authentication downgrade, so the tag understates the integrity/auth-bypass dimension - treat it as an authentication-strength weakness, not merely data exposure.

A deployment configures Tomcat's OpenSSL/APR TLS connector to require client certificate verification (mTLS) for a protected application. An unauthenticated attacker repeatedly initiates TLS handshakes to hit the race condition in Tomcat Native, occasionally causing the client-certificate requirement to be down-graded so the connection is accepted without a valid client certificate, bypassing mutual authentication. No public exploit code is identified, and success is probabilistic due to the AC:H timing window.