CVE-2026-68569

Katalog CVE

CVSS 8.1 · High EPSS 0,46%

Kerentanan Improper Authentication pada apache tomcat. Skor CVSS 3.1 8.1 (High) menurut CISA ADP.

Deskripsi (NVD)

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Rincian

Terbit di NVD

25 Agustus 2026

Terakhir diubah

21 September 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/8robqo76q0osxgw0b5lcwgz0hcf9h4zc mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/08/26/8 mailing list · advisory pihak ketiga