Status: UPDATED | Advisory ID: CVE-2026-68569
| CVE | CVE-2026-68569 |
| CVSS Score / Version | 8.1 (High) / CVSS v3.1 |
| Updated | 2026-09-21 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| CVSS Prose | attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is none. |
| Affected products | Apache Tomcat and Apache Software Foundation Apache Tomcat |
| Classified as | CWE-287 (Improper Authentication) |
| Vendor | Product | Affected Versions | Patch Status |
|---|---|---|---|
| Apache | Tomcat | ||
| Apache Software Foundation | Apache Tomcat |
| Subsystems | General OT |
| Sectors | Multiple |
Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue. (NVD)
Monitor Apache's and Apache Software Foundation's web pages for any future patch releases. See vendor advisory link below.
| Source | Reference |
|---|---|
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2026-68569 |
| CVE | https://www.cve.org/CVERecord?id=CVE-2026-68569 |
| Vendor advisory | https://lists.apache.org/thread/8robqo76q0osxgw0b5lcwgz0hcf9h4zc |