Multiples vulnérabilités dans Apache Tomcat (26 août 2026)
De multiples vulnérabilités ont été découvertes dans Apache Tomcat. Elles permettent à un attaquant de provoquer un déni de service à distance et un contournement de la politique de sécurité.
CSIRTS triage
- What
- Multiple vulnerabilities in Apache Tomcat enable remote denial of service and security policy bypass.
- Who is affected
- Apache Tomcat deployments.
- Urgency
- Moderate; denial of service and policy bypass issues present.
- Action
- Apply Apache Tomcat security updates.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Tomcat
Get an email when a new Tomcat advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1083/
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-329900.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-687630.83% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 55% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-685690.53% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-651830.45% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-685250.63% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 48% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-656370.75% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 53% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-651820.59% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 46% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-731800.54% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-664220.57% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-662990.53% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-32990 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-68763 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-68569 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-65183 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-68525 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-65637 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-65182 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-73180 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-66422 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-66299 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-65905 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-65927 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- medium[UPDATE] [mittel] Apache Tomcat: Schwachstelle ermöglicht Denial of Servicecert-bund
- high[UPDATE] [hoch] Apache Tomcat: Mehrere Schwachstellencert-bund
- highexploited[UPDATE] [hoch] Apache Tomcat und Tomcat Native: Mehrere Schwachstellencert-bund
- unknownMultiples vulnérabilités dans les produits IBM (11 septembre 2026)cert-fr-avis
- criticalGHSA-9xv2-5v5q-p794: Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulne…ghsa
- criticalGHSA-h3x4-894j-xpx5: Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerabilityghsa
- criticalGHSA-gcx9-497g-6cp6: Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerabilityghsa
- mediumCVE-2026-73180: Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID fo…nvd
- highCVE-2026-68763: Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the…nvd
- highCVE-2026-68569: Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. …nvd
- criticalCVE-2026-68525: Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows th…nvd
- highCVE-2026-66422: Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions b…nvd
More from CERT-FR Avis de sécurité
- unknownMultiples vulnérabilités dans MongoDB (14 septembre 2026)2026-09-14
- unknownVulnérabilité dans CPython (14 septembre 2026)2026-09-14
- unknownMultiples vulnérabilités dans Squid (14 septembre 2026)2026-09-14
- unknownMultiples vulnérabilités dans Microsoft Edge (14 septembre 2026)2026-09-14
- unknownMultiples vulnérabilités dans MISP (14 septembre 2026)2026-09-14