CVE-2026-86247CWE-366

CVE-2026-86247

High · published September 23, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
11.5
In the wild
Unconfirmed
What it is

Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.

This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.

Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00216 · 11.5th percentile
Weakness
CWE-366 · Race Condition within a Thread
Published
2026-09-23T17:17Z
Affected products (2)
ProductVersionsFixed in
apache/tomcat_native≥ 1.3.0, < 1.3.91.3.9
apache/tomcat_native≥ 2.0.0, < 2.0.162.0.16
References (2)
https://lists.apache.org/thread/obsson6zhvfg0wsp2bx602l61ltj87r1 · [email protected]http://www.openwall.com/lists/oss-security/2026/09/23/33 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 23 SEP 12:31Z
    Apache Tomcat Native: Client certificate requirements can be down-graded
    cvelistv5