CVE-2026-86246: apache software foundation apache tomcat native
Vulnerability summary
CVE-2026-86246 is a critical (CVSS 9.1) vulnerability in apache software foundation apache tomcat native. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 8 · Related 7Timeline
- 23-09-2026PublishedVulnerability first disclosed.
- 23-09-2026Last modifiedVulnerability information updated.
Description
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.36%
Chance of exploitation in the next 30 days
Percentile
28%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache1 product
- tomcat_native≥ 1.3.0, < 1.3.9 | ≥ 2.0.0, < 2.0.16
Apache software foundation1 product
- apache tomcat native≥ 2.0.0, ≤ 2.0.15 | ≥ 1.3.0, ≤ 1.3.8
Debian1 product
- tomcat-nativeAll versions (No fix recorded) | < 2.0.16-1
Ubuntu1 product
- tomcat-nativeAll versions (No fix recorded)
4 vendors · 4 products
