[UPDATE] [hoch] Apache Tomcat: Mehrere Schwachstellen

CSIRTS triage

What

Multiple vulnerabilities in Apache Tomcat allow privilege escalation, security bypass, data manipulation or disclosure, and denial-of-service.

Who is affected

All deployments of Apache Tomcat running vulnerable versions.

Urgency

High priority; multiple attack vectors including remote exploitation and privilege escalation pose significant risk.

Action

Update Apache Tomcat to a patched version addressing CVE-2026-65182, CVE-2026-65183, CVE-2026-65637, CVE-2026-65905, CVE-2026-65927, CVE-2026-66422, CVE-2026-68525, and CVE-2026-68569.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

high

Published

2026-09-04

Exploitation

Not in CISA KEV at last sync

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3007

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-651820.59% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 46% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-651830.45% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-656370.75% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 53% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-659050.77% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 53% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-659270.78% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 54% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-664220.57% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-685250.63% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 48% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-685690.53% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-687630.83% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 55% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-731800.54% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• criticalGHSA-9xv2-5v5q-p794: Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulne…ghsa
• criticalGHSA-h3x4-894j-xpx5: Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerabilityghsa
• criticalGHSA-gcx9-497g-6cp6: Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerabilityghsa
• unknownMultiples vulnérabilités dans Apache Tomcat (26 août 2026)cert-fr-avis
• mediumCVE-2026-73180: Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID fo…nvd
• highCVE-2026-68763: Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the…nvd
• highCVE-2026-68569: Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. …nvd
• criticalCVE-2026-68525: Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows th…nvd
• highCVE-2026-66422: Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions b…nvd
• highCVE-2026-65927: Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves c…nvd
• criticalCVE-2026-65905: Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator.…nvd
• criticalCVE-2026-65637: Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32…nvd

Recent advisories for Apache Tomcat

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• highexploited[UPDATE] [hoch] Apache Tomcat und Tomcat Native: Mehrere Schwachstellencert-bund · 2026-09-04
• high[UPDATE] [high] Apache Tomcat and Tomcat Native: Multiple vulnerabilitiescert-bund · 2026-09-02
• medium[UPDATE] [medium] Apache Tomcat: Multiple vulnerabilitiescert-bund · 2026-09-01
• high[UPDATE] [high] Apache Tomcat: Multiple vulnerabilitiescert-bund · 2026-09-01
• criticalGHSA-9xv2-5v5q-p794: Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulne…ghsa · 2026-08-26
• criticalGHSA-gcx9-497g-6cp6: Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerabilityghsa · 2026-08-26

More from CERT-Bund (BSI) Security Advisories

• medium[UPDATE] [mittel] vim: Mehrere Schwachstellen2026-09-10
• medium[UPDATE] [mittel] ffmpeg: Mehrere Schwachstellen ermöglichen Codeausführung und DoS2026-09-10
• medium[UPDATE] [mittel] Unbound: Mehrere Schwachstellen2026-09-10
• high[UPDATE] [hoch] ffmpeg: Mehrere Schwachstellen2026-09-10
• high[UPDATE] [hoch] Internet Systems Consortium BIND: Mehrere Schwachstellen2026-09-10