Apache product

Tomcat

No CISA KEV deadline is open. CISA last added a Tomcat CVE on 4 Aug. Coverage is above its usual rate: 3 articles in 7 days, against a weekly average of 0.1.

Tracked since 14 Apr · latest article Fri 23 Oct · RSS

Open KEV deadlines: 0; None open
Added to KEV · 90 days: 1; of 6 in the full CISA catalogue · all time
High exploit odds · current: 0; EPSS top 5%, not in KEV
Articles · 7 days: 3; ↑ vs 0.1 a week

Exploited, by due date

CSV download

CVEProductAddedDue · federal deadline

Deadlines passed

CVE-2026-34486Tomcat4 AugDeadline passed 7 Aug7 articles

CVE-2025-24813not in CyberSIXT coverageTomcat1 Apr 2025Deadline passed 22 Apr 2025

CVE-2016-8735not in CyberSIXT coverageTomcat12 May 2023Deadline passed 2 Jun 2023

CVE-2017-12615not in CyberSIXT coverageTomcat25 Mar 2022Deadline passed 15 Apr 2022Known ransomware use

CVE-2017-12617not in CyberSIXT coverageTomcat25 Mar 2022Deadline passed 15 Apr 2022

CVE-2020-1938not in CyberSIXT coverageTomcat3 Mar 2022Deadline passed 17 Mar 2022

Coverage

12 articles · all timeFull timeline

12 articles from 5 outlets since 14 Apr; 3 in the last 7 days.

Article
First report
Official notice

Show as table

Tomcat: articles
Published (UTC)	Outlet	Headline
Fri 23 Oct · 08:36 UTC	SecurityWeek	Atlassian Flags 162 High and 14 Critical Flaws in Server Products
Wed 21 Oct · 11:01 UTC	SecurityOnline	Atlassian patches 176 flaws across Jira and Confluence products
Wed 21 Oct · 03:01 UTC	SecurityOnline	Apache Tomcat fixes authentication bypass and data leaks in key releases
Wed 23 Sep · 20:38 UTC	SecurityOnline	Apache Tomcat 11.0.26 Fixes 15 Flaws Enabling Request Smuggling and DoS
Wed 5 Aug · 16:29 UTC	Security Affairs	CISA Flags Critical Flaws in IBM Langflow, N able and Tomcat
Wed 5 Aug · 10:11 UTC	SecurityWeek	CISA warns of exploits in IBM Langflow, Nable, and Tomcat flaws
Wed 5 Aug · 09:01 UTC	SecurityOnline	Apple tightens bug bounty amid surge of AI generated flaw reports
Wed 5 Aug · 03:51 UTC	SecurityOnline	N-able N-central Flaw Exploited in the Wild as CISA Adds Three to KEV Catalog
Tue 4 Aug · 17:05 UTC	CISA	CISA Adds Apache Tomcat Flaw CVE-2026-34486 to KEV Catalog
Tue 4 Aug · 16:55 UTC	CISA	CISA warns Apache Tomcat flaw CVE-2026-34486 risks data
Wed 1 Jul · 03:52 UTC	SecurityOnline	Apache Tomcat fixes auth bypass CVE-2026-55957 in versions 7 to 11
Tue 14 Apr · 08:08 UTC	SOCRadar	Apache Tomcat Tribes flaw exposes cluster to unauthenticated RCE

Who reported 5 outlets, last 12 months

SecurityOnline6
CISA2
SecurityWeek2
SOCRadar1
Security Affairs1

23 OctAtlassian Flags 162 High and 14 Critical Flaws in Server ProductsSecurityWeek
21 OctAtlassian patches 176 flaws across Jira and Confluence productsSecurityOnline
21 OctApache Tomcat fixes authentication bypass and data leaks in key releasesSecurityOnline
23 SepApache Tomcat 11.0.26 Fixes 15 Flaws Enabling Request Smuggling and DoSSecurityOnline
5 AugCISA Flags Critical Flaws in IBM Langflow, N able and TomcatSecurity Affairs
5 AugCISA warns of exploits in IBM Langflow, Nable, and Tomcat flawsSecurityWeek
5 AugApple tightens bug bounty amid surge of AI generated flaw reportsSecurityOnline
5 AugN-able N-central Flaw Exploited in the Wild as CISA Adds Three to KEV CatalogSecurityOnline
4 AugCISA Adds Apache Tomcat Flaw CVE-2026-34486 to KEV CatalogCISA · official notice
4 AugCISA warns Apache Tomcat flaw CVE-2026-34486 risks dataCISA · official notice

All CVEs in coverage

CVE-2026-34486Apache Tomcat Missing Encryption of Sensitive Data VulnerabilityCVSS9.8CriticalExploited99%EPSS7articles

CVE-2026-55957Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bindCVSS7.3High–Not in KEV2.9%EPSS1article

CVE-2026-77791Apache Tomcat: DoS via busy wait during WebSocket closeCVSS7.5High–Not in KEV0.7%EPSS1article

CVE-2026-101296Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanismsCVSS9.1Critical–Not in KEV0.6%EPSS1article

CVE-2026-65637Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incompleteCVSS9.8Critical–Not in KEV0.6%EPSS2articles

CVE-2026-103119Apache Tomcat: AJP response mix-upCVSS9.1Critical–Not in KEV0.6%EPSS1article

CVE-2026-76183Apache Tomcat: Bypass of security constraints for WebSocket endpointsCVSS9.8Critical–Not in KEV0.6%EPSS0articles

CVE-2026-87022Apache Tomcat: WebSocket message smuggling with per-message-deflateCVSS7.5High–Not in KEV0.5%EPSS1article

CVE-2026-65182Apache Tomcat: Bypass longest prefix security constraintCVSS9.1Critical–Not in KEV0.5%EPSS2articles

CVE-2026-78383Apache Tomcat: AJP DoS via missing request bodyCVSS7.5High–Not in KEV0.5%EPSS1article

CVE-2026-101356Apache Tomcat: HTTP/2 request/response mix-up after error during async processingCVSS9.1Critical–Not in KEV0.5%EPSS1article

CVE-2026-86248Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabledCVSS9.8Critical–Not in KEV0.5%EPSS1article

3 more CVEs

CVE-2026-68525Apache Tomcat: Redirect after FORM auth may bypass method specific constraintsCVSS9.1Critical–Not in KEV0.5%EPSS2articles

CVE-2026-86350Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-upCVSS9.1Critical–Not in KEV0.3%EPSS1article

CVE-2026-78437Apache Tomcat: HTTP/2 DoS via malformed requestCVSS7.3High–Not in KEV0.3%EPSS1article

How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.

Tomcat

Exploited, by due date

Coverage

All CVEs in coverage

On this device

Intel

Settings

Keyboard shortcuts