PT-2026-97298 · Apache · Apache Tomcat

Mike Read

·

CVE-2026-86248

·

Published

2026-09-15

·

Updated

2026-10-01

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M14 through 11.0.25 Apache Tomcat versions 10.1.22 through 10.1.59 Apache Tomcat versions 9.0.92 through 9.0.121
Description CLIENT CERT authentication does not fail as expected in certain scenarios when the soft fail option is disabled.
Recommendations Upgrade to version 11.0.26. Upgrade to version 10.1.60. Upgrade to version 9.0.122.

Fix

Improper Authentication

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-287

Related Identifiers

BIT-TOMCAT-2026-86248
CVE-2026-86248
OPENSUSE-SU-2026:11906-1
OPENSUSE-SU-2026:11907-1
OPENSUSE-SU-2026:11908-1
OPENSUSE-SU-2026:21984-1

Affected Products

Apache Tomcat