CVE-2026-65182: apache software foundation apache tomcat Improper Access Control
CVSS: 9.1v3.1CriticalAnalyzed
AliasesUBUNTU-CVE-2026-65182DEBIAN-CVE-2026-65182CGA-77gq-pf4q-wqf9CGA-8frm-xf9m-94mjCGA-9phq-wc6m-w977CGA-xhcg-8w9j-363cCGA-3xc9-c83g-p783CGA-4cxp-q5fx-c7g6CGA-4fg7-3m43-78jwCGA-55wv-gg3j-3m76CGA-5cxm-vwqw-wfh6CGA-5m66-25ch-p3q4CGA-5qpx-v3f4-7qr7CGA-5rj6-83xf-hx68CGA-5wr5-f67p-5569CGA-65jv-wfvc-588vCGA-76q5-3ww4-m5g4CGA-7jf3-w64p-w44cCGA-83rx-vc5q-j62vCGA-88mj-h596-xf7pCGA-93gh-cmfv-ph8hCGA-9cqr-q496-p8hcCGA-9mhw-r7h4-284mCGA-9w9p-9g95-vrfqCGA-c925-29wp-275fCGA-cg77-3wqg-5vccCGA-ffx9-qj8m-3x2mCGA-fv3h-qvwx-5wqqCGA-fv6g-hpqh-mmgxCGA-h36q-2v74-76vqCGA-hjgm-r7vf-9whrCGA-hw7r-v693-9322CGA-j5fv-x963-55x7CGA-jcq3-h6v5-gm7hCGA-jfjr-rfvf-3gmxCGA-m6xv-2f82-7r62CGA-m893-5v2v-6qwxCGA-mf6w-252m-hwffCGA-mjwh-x7qp-f36wCGA-pfmm-f5wx-vv7gCGA-prmp-wmx6-8q73GHSA-gcx9-497g-6cp6BIT-tomcat-2026-65182CGA-q87v-7p3f-q9xvCGA-qc2w-9xg4-5ffvCGA-qhfp-fgqp-97jmCGA-qxwm-vmq2-fcrqCGA-rww5-32wp-6xx2CGA-vchh-65g6-gp48CGA-vchh-mv4m-g43xCGA-wxpj-29mc-8mj4CGA-xxjc-hhgp-6g8v
Published 25-08-2026Last modified 26-08-2026
Vulnerability summary
CVE-2026-65182 is a critical (CVSS 9.1) Improper Access Control vulnerability in apache software foundation apache tomcat. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44% of scored vulnerabilities.
CVSS score
9.1/10
010
Critical · v3.1 (CVE.org)EPSS score
0.54%
0%100%
Low · -0.05 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 21 · Related 17MGASA-2026-0376OPENSUSE-SU-2026:11759-1OPENSUSE-SU-2026:11760-1OPENSUSE-SU-2026:11761-1OPENSUSE-SU-2026:21810-1OPENSUSE-SU-2026:21811-1OPENSUSE-SU-2026:21823-1RHSA-2026:56039RHSA-2026:63137RHSA-2026:73981RHSA-2026:76952SUSE-SU-2026:23690-1SUSE-SU-2026:23691-1SUSE-SU-2026:23700-1SUSE-SU-2026:23710-1SUSE-SU-2026:23711-1SUSE-SU-2026:23720-1SUSE-SU-2026:4114-1SUSE-SU-2026:4119-1SUSE-SU-2026:4126-1SUSE-SU-2026:4203-1CGA-8J69-QM95-C772
Timeline
- 25-08-2026PublishedVulnerability first disclosed.
- 26-08-2026Last modifiedVulnerability information updated.
Description
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
CVSS metrics
7 scores · 7 sources · 1 versionCritical 9.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · MavenEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.54%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
-0.05 pp
From 0.59% on 18-09-2026
18-09-202618-10-2026
EPSS score0.54%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Chainguard24 products
- camunda-8.8< 8.8.37-r1
- camunda-8.9< 8.9.18-r1
- camunda-zeebe-8.6< 8.6.39-r12
- camunda-zeebe-8.7< 8.7.38-r1
- camunda-zeebe-8.8< 8.8.37-r1
Ubuntu6 products
- tomcat10All versions (No fix recorded)
- tomcat11All versions (No fix recorded)
- tomcat6All versions (No fix recorded)
- tomcat7All versions (No fix recorded)
- tomcat8All versions (No fix recorded)
Debian3 products
- tomcat10All versions (No fix recorded) | < 10.1.60-1
- tomcat11All versions (No fix recorded)
- tomcat9< 9.0.70-2
Org.apache.tomcat2 products
- tomcat≥ 11.0.0-M1, < 11.0.25 | ≥ 10.1.0-M1, < 10.1.58 | ≥ 9.0.0-M1, < 9.0.121 | ≥ 8.5.0, ≤ 8.5.100 | ≥ 7.0.0, ≤ 7.0.109
- tomcat-catalina≥ 11.0.0-M1, < 11.0.25 | ≥ 10.1.0-M1, < 10.1.58 | ≥ 9.0.0-M1, < 9.0.121 | ≥ 8.5.0, ≤ 8.5.100 | ≥ 7.0.0, ≤ 7.0.109
Wolfi2 products
- thingsboard-tb-mqtt-transport< 4.3.1.4-r2
- thingsboard-tb-node< 4.3.1.4-r2
Apache1 product
- tomcat≥ 7.0.0, ≤ 7.0.109 | ≥ 8.5.0, < 9.0.121 | ≥ 10.1.0, < 10.1.58 | ≥ 11.0.0, < 11.0.25
Apache software foundation1 product
- apache tomcat≥ 11.0.0-M1, ≤ 11.0.24 | ≥ 10.1.0-M1, ≤ 10.1.57 | ≥ 9.0.0.M1, ≤ 9.0.120 | ≥ 8.5.0, ≤ 8.5.100 | ≥ 7.0.0, ≤ 7.0.109
Org.apache.tomcat.embed1 product
- tomcat-embed-core≥ 11.0.0-M1, < 11.0.25 | ≥ 10.1.0-M1, < 10.1.58 | ≥ 9.0.0-M1, < 9.0.121 | ≥ 8.5.0, ≤ 8.5.100 | ≥ 7.0.0, ≤ 7.0.109
8 vendors · 40 products
