CVE-2026-86246
📛 CVE Title
Apache Tomcat Native: Insecure OpenSSL options enabled
Description
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- apache
- CVSS severity
- —
- CVSS score
- —
- CVSS vector
- —
- Effective score
- 9.1 / 10 CRITICAL source: NVD
- CWE(s)
-
CWE-1188 - Reserved
- 2026-09-06
- Published
- 2026-09-23 12:26 UTC
- Last updated
- 2026-09-23 18:10 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86246.json
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-09-23 13:17:31 UTC
- NVD last modified
- 2026-09-23 19:19:41 UTC
- NVD CVSS v3.1
- 9.1 / 10 CRITICAL source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N- Exploitability subscore
- 3.9 / 10
- Impact subscore
- 5.2 / 10
NVD / KEV / EPSS data refreshed 2026-09-24 04:33 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-85268 - Assigner
- apache
- Published
- Sep 23, 2026, 12:26:40 PM
- Updated
- Sep 23, 2026, 6:10:49 PM
- EUVD base score (CVSS 3.1)
-
9.1 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - EUVD-reported EPSS
- 0.0000
- Vendors
- Apache Software Foundation
- Products
-
Apache Tomcat Native (2.0.0 ≤2.0.15)Apache Tomcat Native (1.3.0 ≤1.3.8)
- Aliases
-
GHSA-9p2m-jvmj-wh8q
ENISA description: Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.
EUVD references (1)
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Apache Software Foundation | Apache Tomcat Native |
2.0.0 (affected),
1.3.0 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
- https://lists.apache.org/thread/dgyvfwb24nbk45ptvlhdyhdhl5o7k5ol vendor-advisory
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (2)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- http://www.openwall.com/lists/oss-security/2026/09/23/32 af854a3a-2127-422b-91ae-364da2661108
- https://lists.apache.org/thread/dgyvfwb24nbk45ptvlhdyhdhl5o7k5ol security@apache.org
Remediations (10)
-
web:msrc.microsoft.com
Security Update Guide - Microsoft Security Response Center
2026-09-24 11:49 UTC -
web:senserva.com
Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.
2026-09-24 11:49 UTC -
web:shattered.io
Google patched Chrome zero-day CVE - 2026 -85046, its 6th actively exploited bug of 2026 . What the V8 flaw means for enterprises.
2026-09-24 11:49 UTC -
web:support.servicenow.com
Due to additional analysis provided by the security researcher who discovered CVE - 2026 -6876, we have upgraded the severity rating of CVE - 2026 -6876 from High to Critical. This change affects only the severity
2026-09-24 11:49 UTC -
web:tech-insider.org
Google patched actively exploited Chrome zero-day CVE - 2026 -85046 on Sept 4, 2026 . CISA set a Sept 18 federal deadline. Here is what to know.
2026-09-24 11:49 UTC -
web:thecybersecguru.com
CVE - 2026 -85046 is a V8 type confusion zero-day already exploited in Chrome. Here's how the read/write primitive works, and how to patch immediately
2026-09-24 11:49 UTC -
web:www.cisa.gov
BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.
2026-09-24 11:49 UTC -
web:www.helpnetsecurity.com
Google has patched 12 vulnerabilities affecting its popular Chrome browser, among them CVE - 2026 -85046, which has been exploited in the wild.
2026-09-24 11:49 UTC -
web:www.ibm.com
WebSphere Application Server is shipped as a component of WebSphere Service Registry and Repository. Information about multiple vulnerabilities affecting WebSphere Application Server have been published in security bulletins.
2026-09-24 11:49 UTC -
web:www.malwarebytes.com
Update Chrome now: Two critical vulnerabilities could allow a malicious website to run code on your device.
2026-09-24 11:49 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-86246.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86246",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T15:29:46.583140Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T15:30:08.342Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-23T18:10:49.726Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/23/32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Tomcat Native",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.0.15",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "1.3.8",
"status": "affected",
"version": "1.3.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.</p><p>This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.</p><p>Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.</p>"
}
],
"value": "Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options\u00a0by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.\n\n\n\nThis issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1188",
"description": "CWE-1188 Initialization of a resource with an insecure default",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T12:26:40.789Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/dgyvfwb24nbk45ptvlhdyhdhl5o7k5ol"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache Tomcat Native: Insecure OpenSSL options enabled",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-86246",
"datePublished": "2026-09-23T12:26:40.789Z",
"dateReserved": "2026-09-06T09:45:10.745Z",
"dateUpdated": "2026-09-23T18:10:49.726Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}