CVE-2026-86246CWE-1188

CVE-2026-86246

Critical · published September 23, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
28.7
In the wild
Unconfirmed
What it is

Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.

This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.

Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00361 · 28.7th percentile
Weakness
CWE-1188 · Initialization of a Resource with an Insecure Default
Published
2026-09-23T17:17Z
Affected products (2)
ProductVersionsFixed in
apache/tomcat_native≥ 1.3.0, < 1.3.91.3.9
apache/tomcat_native≥ 2.0.0, < 2.0.162.0.16
References (2)
https://lists.apache.org/thread/dgyvfwb24nbk45ptvlhdyhdhl5o7k5ol · [email protected]http://www.openwall.com/lists/oss-security/2026/09/23/32 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 23 SEP 12:26Z
    Apache Tomcat Native: Insecure OpenSSL options enabled
    cvelistv5