Apache Tomcat and Tomcat Native Multiple Vulnerabilities, CVSS 7.3
Summary
CERT-Bund issued security advisory WID-SEC-2026-1038 identifying multiple vulnerabilities in Apache Tomcat and Tomcat Native with a CVSS Base Score of 7.3 (high). Affected versions include Apache Tomcat <9.0.117, <10.1.54, <11.0.21, and Tomcat Native <1.3.7, <2.0.14. An attacker can exploit these flaws to bypass security measures, manipulate data, disclose confidential information, and conduct open-redirect attacks.
What changed
CERT-Bund published a security advisory detailing multiple vulnerabilities in Apache Tomcat and Apache Tomcat Native. The vulnerabilities affect versions prior to 9.0.117, 10.1.54, 11.0.21 (Tomcat), and prior to 1.3.7, 2.0.14 (Tomcat Native). The CVSS Base Score of 7.3 indicates high severity with remote attack capability.
Organizations running affected Apache Tomcat installations on UNIX, Windows, or other platforms should immediately apply available patches. The advisory indicates mitigation is available, and updating to the latest versions resolves these security issues. System administrators should prioritize patching internet-facing Tomcat servers given the remote attack vector and multiple potential impact categories including data disclosure and security bypass.
What to do next
- Update Apache Tomcat to version 9.0.117, 10.1.54, or 11.0.21 or later
- Update Apache Tomcat Native to version 1.3.7 or 2.0.14 or later
- Review systems for signs of exploitation
Archived snapshot
Apr 12, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
[WID-SEC-2026-1038] Apache Tomcat und Tomcat Native: Mehrere Schwachstellen CVSS Base Score 7.3 (hoch) CVSS Temporal Score 6.4 (mittel) Remoteangriff ja Datum 09.04.2026 Stand 10.04.2026 Mitigation ja
Betroffene Systeme
Betriebssystem
- Sonstiges
- UNIX
- Windows
Produktbeschreibung
Apache Tomcat ist ein Web-Applikationsserver für verschiedene Plattformen.
Produkte
09.04.2026
- Apache Tomcat <11.0.20
Apache Tomcat <10.1.52
Apache Tomcat <9.0.116
Apache Tomcat <10.1.53
Apache Tomcat Native <1.3.7
Apache Tomcat Native <2.0.14
Apache Tomcat <11.0.19
Apache Tomcat <11.0.21
Apache Tomcat <10.1.54
Apache Tomcat <9.0.117
Angriff
Angriff
Ein Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, Open-Redirect-Angriffe durchzuführen und andere, nicht näher spezifizierte Angriffe auszuführen. CVE Informationen Versionshistorie Feedback zum Advisory geben
Related changes
Get daily alerts for CERT-Bund Security Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CERT-Bund.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CERT-Bund Security Advisories publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.