Skip to content
Fencer Vulns
high 7.4

CVE-2026-86247 json

Apache Tomcat Native: Client certificate requirements can be down-graded

published 2026-09-23 46 d ago modified 2026-10-06 33 d ago also EUVD-2026-85270

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits
0
none known

Summary

Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.

This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.

Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.

Patch / fix

  • apache tomcat_native 1.3.9, 2.0.16
  • tomcat-native Debian 14 2.0.16-1

debian advisories DEBIAN-CVE-2026-86247

  • libtcnative-2-0 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +9 more 2.0.16-150400.9.6.1
  • tomcat10 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES 15 SP6-LTSS +4 more 10.1.60-150200.5.82.2
  • tomcat SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 9.0.122-150200.123.2
  • libtcnative-1-0 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 1.3.9-150200.6.11.2
  • tomcat11 SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Web and Scripting 15 SP7 11.0.26-150600.13.36.2
  • libtcnative-1-0 SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Web and Scripting 15 SP7 +1 more 1.3.9-150600.16.9.2
  • tomcat11 SLES for SAP applications 16.0, SLES 16.0 11.0.26-160000.1.1
  • tomcat SLES for SAP applications 16.0, SLES 16.0 9.0.122-160000.1.1

suse advisories SUSE-SU-2026:4927-1SUSE-SU-2026:4658-1SUSE-SU-2026:4546-1SUSE-SU-2026:4544-1SUSE-SU-2026:23985-1

  • tomcat11 openSUSE Leap 16.0 11.0.26-160000.1.1
  • tomcat openSUSE Leap 16.0 9.0.122-160000.1.1
  • tomcat10 openSUSE Leap 16.0 10.1.60-160000.1.1
  • libtcnative-1-0 openSUSE Leap 16.0 1.3.9-160000.1.1
  • libtcnative-2-0 openSUSE Leap 16.0 2.0.16-160000.1.1
  • libtcnative-1-0 openSUSE Tumbleweed 1.3.9-1.1
  • libtcnative-2-0 openSUSE Tumbleweed 2.0.16-1.1

opensuse advisories openSUSE-SU-2026:21984-1openSUSE-SU-2026:11898-1openSUSE-SU-2026:11899-1

  • tomcat-native Alpine 3.24 2.0.16-r0

alpine advisories ALPINE-CVE-2026-86247

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-86247 updated cvss 4.8

tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition

  • Red Hat JBoss Web Server 5 jws5-tomcat-native
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Web Server 6 jws6-tomcat-native
    affected: workaround, no fix available
  • Red Hat JBoss Web Server 7.0 on RHEL 8 jws7-tomcat-native 1.3.7-4.redhat_4.el8jws, jws7-tomcat 11.0.21-10.redhat_00010.1.el8jws, jws7-tomcat-lib 11.0.21-10.redhat_00010.1.el8jws, jws7-mod_cluster 2.1.1-1.Final_redhat_00001.1.el8jws, jws7-tomcat-javadoc 11.0.21-10.redhat_00010.1.el8jws, jws7-tomcat-selinux 11.0.21-10.redhat_00010.1.el8jws, +7 more Red Hat JBoss Web Server 7.0 on RHEL 9 jws7-tomcat-native 1.3.7-4.redhat_4.el9jws, jws7-tomcat 11.0.21-10.redhat_00010.1.el9jws, jws7-tomcat-lib 11.0.21-10.redhat_00010.1.el9jws, jws7-mod_cluster 2.1.1-1.Final_redhat_00001.1.el9jws, jws7-tomcat-javadoc 11.0.21-10.redhat_00010.1.el9jws, jws7-tomcat-selinux 11.0.21-10.redhat_00010.1.el9jws, +7 more Red Hat JBoss Web Server 7.0 on RHEL 10 jws7-tomcat-native 1.3.7-4.redhat_4.el10jws, jws7-tomcat 11.0.21-10.redhat_00010.1.el10jws, jws7-tomcat-lib 11.0.21-10.redhat_00010.1.el10jws, jws7-mod_cluster 2.1.1-1.Final_redhat_00001.1.el10jws, jws7-tomcat-javadoc 11.0.21-10.redhat_00010.1.el10jws, jws7-tomcat-selinux 11.0.21-10.redhat_00010.1.el10jws, +7 more
    fixed: vendor fix RHSA-2026:93618
  • Red Hat JBoss Web Server 7.0.3
    fixed: vendor fix RHSA-2026:93622

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
46 d ago

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

  • Apache Software Foundation Apache Tomcat Native

Classification

Weakness
  • CWE-366 Race Condition within a Thread

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.