9.8

CVE-2026-41293: apache software foundation apache tomcat Improper Input Validation

CVSS: 9.8v3.1CriticalAnalyzed
AliasesUBUNTU-CVE-2026-41293DEBIAN-CVE-2026-41293CGA-c535-57xj-jrcv
Published 12-05-2026Last modified 17-09-2026
Open JSON

Vulnerability summary

CVE-2026-41293 is a critical (CVSS 9.8) Improper Input Validation vulnerability in apache software foundation apache tomcat. EPSS estimates a 1.68% chance of exploitation in the next 30 days, higher than 76.5% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
1.68%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 26 · Related 15
MGASA-2026-0139OPENSUSE-SU-2026:10925-1OPENSUSE-SU-2026:10926-1OPENSUSE-SU-2026:10927-1OPENSUSE-SU-2026:21117-1OPENSUSE-SU-2026:21121-1

Timeline

  1. 12-05-2026
    PublishedVulnerability first disclosed.
  2. 17-09-2026
    Last modifiedVulnerability information updated.

Description

Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

1.68%

Chance of exploitation in the next 30 days

Percentile

77%

Versus all other CVEs

30-day change

0.00 pp

From 1.68% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.68%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard24 products
  • camunda-8.8< 8.8.24-r2
  • camunda-8.9< 8.9.5-r2
  • camunda-zeebe-8.6< 8.6.39-r12
  • camunda-zeebe-8.7< 8.7.29-r1
  • camunda-zeebe-8.8< 8.8.24-r1
Debian3 products
  • tomcat10< 10.1.55-1~deb12u1 | < 10.1.55-1~deb13u1 | < 10.1.55-1
  • tomcat11< 11.0.22-1~deb13u1 | < 11.0.22-1
  • tomcat9< 9.0.70-2
Ubuntu3 products
  • tomcat10< 10.1.16-1ubuntu0.1~esm4 | < 10.1.40-1ubuntu1.25.10.1 | < 10.1.40-1ubuntu1.26.04.1
  • tomcat11All versions (No fix recorded) | < 11.0.18-1ubuntu0.1~esm1
  • tomcat9< 9.0.16-3ubuntu0.18.04.2+esm8 | < 9.0.31-1ubuntu0.9+esm3 | < 9.0.58-1ubuntu0.2+esm4 | < 9.0.70-2ubuntu0.1+esm3 | < 9.0.95-1ubuntu1.1 | < 9.0.115-1ubuntu0.1
Org.apache.tomcat2 products
  • tomcat≥ 8.5.0, < 9.0.118 | ≥ 10.1.0-M1, < 10.1.55 | ≥ 11.0.0-M1, < 11.0.22
  • tomcat-coyote≥ 8.5.0, < 9.0.118 | ≥ 10.1.0-M1, < 10.1.55 | ≥ 11.0.0-M1, < 11.0.22
Wolfi2 products
  • thingsboard-tb-mqtt-transport< 4.3.1.2-r0
  • thingsboard-tb-node< 4.3.1.2-r0
Apache1 product
  • tomcat≥ 8.5.0, ≤ 8.5.100 | ≥ 9.0.0, < 9.0.118 | ≥ 10.0.0, ≤ 10.0.27 | ≥ 10.1.0, < 10.1.55 | ≥ 11.0.0, < 11.0.22
Apache software foundation1 product
  • apache tomcat≥ 11.0.0-M1, ≤ 11.0.21 | ≥ 10.1.0-M1, ≤ 10.1.54 | ≥ 9.0.0.M1, ≤ 9.0.117 | ≥ 10.0.0-M1, ≤ 10.0.27 | ≥ 8.5.0, ≤ 8.5.100
Org.apache.tomcat.embed1 product
  • tomcat-embed-core≥ 8.5.0, < 9.0.118 | ≥ 10.1.0-M1, < 10.1.55 | ≥ 11.0.0-M1, < 11.0.22

8 vendors · 37 products

References

22 links
Show all 22 references