USN-8551-1: Tomcat vulnerabilities

unknownpublic exploitCVE-2026-43515 CVE-2026-50229 CVE-2026-53404 CVE-2026-55276

It was discovered that Tomcat incorrectly handled authorization when multiple method constraints defined the same HTTP method. A remote attacker could possibly use this issue to bypass authorization restrictions. (CVE-2026-43515) It was discovered that the Tomcat number guess example application did not properly sanitize user-supplied input. An attacker could possibly use this issue to inject malicious scripts, resulting in cross-site scripting. (CVE-2026-50229) It was discovered that Tomcat incorrectly evaluated rewrite valve conditions in certain configurations. An attacker could possibly use this issue to bypass rewrite rules, resulting in unauthorized access. (CVE-2026-53404) It was discovered that Tomcat incorrectly omitted certain authorization information when logging the effective web.xml configuration. An attacker could possibly use this issue to hide authorization constraints, resulting in reduced auditability. (CVE-2026-55276)

CSIRTS triage

vendor: Apache product: Tomcat Authentication bypass Cross-site scriptingOther

What: Tomcat has multiple vulnerabilities that could allow authorization bypass and cross-site scripting.
Who is affected: Deployments of Tomcat that utilize the affected features.
Urgency: Remediation is urgent due to the potential for exploitation.
Action: Users should review the advisories and apply patches as necessary.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Tomcat

Get an email when a new Tomcat advisory drops — max one per day, one-click unsubscribe.

Details

Source: Ubuntu Security Notices (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-07-15
Exploitation: Not in CISA KEV at last sync

Original advisory: https://ubuntu.com/security/notices/USN-8551-1

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2026-435151.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 63% of all scored CVEs.
Moderate exploitation riskCVE-2026-502294.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 90% of all scored CVEs.
Low exploitation riskCVE-2026-534040.58% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 44% of all scored CVEs.
Low exploitation riskCVE-2026-552760.54% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-43515	coverage & exploitation status	NVD · CVE.org
CVE-2026-50229	coverage & exploitation status	NVD · CVE.org
CVE-2026-53404	coverage & exploitation status	NVD · CVE.org
CVE-2026-55276	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[UPDATE] [high] Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira and Jira Service Management: …cert-bund
high[NEW] [high] SAP Patch Day July 2026cert-bund
high[UPDATE] [high] Apache Tomcat: Multiple vulnerabilitiescert-bund
medium[UPDATE] [medium] Apache Tomcat: Multiple vulnerabilitiescert-bund
unknownNCSC-2026-0230 [1.01] [M/H] Vulnerabilities fixed in SAP productsncsc-nl
unknownMultiple vulnerabilities in SAP products (July 15, 2026)cert-fr-avis
unknownNCSC-2026-0230 [1.00] [M/H] Vulnerabilities fixed in SAP productsncsc-nl
unknownApache Tomcat Multiple Vulnerabilitieshkcert
unknownMultiple vulnerabilities in Apache Tomcat (June 30, 2026)cert-fr-avis
criticalCVE-2026-55276: Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special…nvd
highCVE-2026-53404: Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve me…nvd
mediumCVE-2026-50229: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in…nvd