How severe is CVE-2026-86247?

CVE-2026-86247 has a CVSS 3.x base score of 7.4, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2026-86247 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-86247?

CVE-2026-86247 affects Apache Tomcat Native. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-86247?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-86247 published?

CVE-2026-86247 was published on 2026-09-23 and last updated on 2026-10-06.

CVE-2026-86247

CVE-2026-86247 is a high-severity vulnerability in Apache Tomcat Native with a CVSS 3.x base score of 7.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-366.

Key facts

Severity: High (CVSS 3.x base score 7.4)
EPSS exploit prediction: 0% (7th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-366
Affected product: Apache Tomcat Native
Published: 2026-09-23
Last modified: 2026-10-06

Description

Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.

Frequently asked questions

What is CVE-2026-86247?: Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.
How severe is CVE-2026-86247?: CVE-2026-86247 has a CVSS 3.x base score of 7.4, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2026-86247 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-86247?: CVE-2026-86247 affects Apache Tomcat Native. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-86247?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-86247 published?: CVE-2026-86247 was published on 2026-09-23 and last updated on 2026-10-06.

References

Affected products (1)

cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*

More vulnerabilities in Apache Tomcat Native

CVE-2026-86246 — Critical (CVSS 9.1): Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure…
CVE-2026-29145 — Critical (CVSS 9.1): CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in…
CVE-2026-86243 — High (CVSS 7.5): Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a…
CVE-2026-24734 — High (CVSS 7.5): Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat…
CVE-2018-8020 — High (CVSS 7.4): Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced…
CVE-2018-8019 — High (CVSS 7.4): When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid…

All CVEs affecting Apache Tomcat Native →

Other CWE-366 vulnerabilities

CVE-2025-58143 — Critical (CVSS 9.8): [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to…
CVE-2025-31115 — High (CVSS 8.7): XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0,…
CVE-2026-25687 — High (CVSS 8.1): A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap…
CVE-2026-46181 — High (CVSS 7.8): In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in…
CVE-2024-10630 — High (CVSS 7.8): A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local authenticated attacker to…
CVE-2023-6546 — High (CVSS 7.0): A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads…

Browse all CWE-366 vulnerabilities →