CVE-2026-15554

Aliases:DEBIAN-CVE-2026-15554UBUNTU-CVE-2026-15554
Advisory lineage Upstream: 0 Downstream: 3
Awaiting Analysis
Published: 11 Aug 2026, 08:49
Last modified:17 Sept 2026, 23:27

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.4 HIGH
v3.1 (cve.org)
EPSS Score
0.24% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

11 Aug 2026, 08:49
Published
Vulnerability first disclosed
17 Sept 2026, 23:27
Last Modified
Vulnerability information updated

Description

the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.

CVSS Metrics

  • v3.1•HIGH•Score: 7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Trends

Current EPSS score: 0.24%• Percentile: 15%

Techniques & Countermeasures

  • CWE-295•Improper Certificate Validation

    The product does not validate, or incorrectly validates, a certificate.

Affected Systems

  • debian•undertow

    all

  • ubuntu•undertow

    all | all

References (9)