CVE-2026-86248
📛 CVE Title
Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
Description
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- apache
- CVSS severity
- —
- CVSS score
- —
- CVSS vector
- —
- Effective score
- 9.8 / 10 CRITICAL source: NVD
- CWE(s)
- —
- Reserved
- 2026-09-06
- Published
- 2026-09-23 11:29 UTC
- Last updated
- 2026-09-23 16:14 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86248.json
- Linked Threat
- CVE-2026-86248 — Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-09-23 12:17:08 UTC
- NVD last modified
- 2026-09-23 17:58:26 UTC
- NVD CVSS v3.1
- 9.8 / 10 CRITICAL source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Exploitability subscore
- 3.9 / 10
- Impact subscore
- 5.9 / 10
NVD-assigned CWE(s):
CWE-287
(differs from the CNA list above)
NVD / KEV / EPSS data refreshed 2026-09-24 04:33 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-85234 - Assigner
- apache
- Published
- Sep 23, 2026, 11:29:35 AM
- Updated
- Sep 23, 2026, 4:14:59 PM
- EUVD base score (CVSS 3.1)
-
9.8 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EUVD-reported EPSS
- 0.0000
- Vendors
- Apache Software Foundation
- Products
-
Apache Tomcat (9.0.92 ≤9.0.121)Apache Tomcat (11.0.0-M14 ≤11.0.25)Apache Tomcat (10.1.22 ≤10.1.59)
- Aliases
-
GHSA-c47j-g3rg-hrfq
ENISA description: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
EUVD references (1)
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Apache Software Foundation | Apache Tomcat |
11.0.0-M14 (affected),
10.1.22 (affected),
9.0.92 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
- https://lists.apache.org/thread/nmkmjp9l53y8h3oc4n8fc0bkw9dv15sk vendor-advisory
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://lists.apache.org/thread/nmkmjp9l53y8h3oc4n8fc0bkw9dv15sk security@apache.org
Remediations (17)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:app.opencve.io
The vulnerability arises when Tomcat's client certificate authentication fails to reject connections that should be denied, even when the soft‑fail option is disabled. This flaw allows attackers to present a malformed or otherwise invalid certificate that is unknowingly accepted, providing unauthorized access to protected resources. The weakness lies in the certificate validation logic ...
2026-09-24 11:49 UTC -
web:blogs.oracle.com
For more information about the Critical Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.
2026-09-24 11:49 UTC -
web:cvetodo.com
CVE-2026-86248 is a CVSS 9.8 Improper Authentication vulnerability in Apache Tomcat. See exploitation status, patch guidance, and technical details.
2026-09-24 11:49 UTC -
web:cybersixt.com
CVE-2026-86248 : CVSS 9.8 critical, affecting Apache Software Foundation Apache Tomcat. CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apac
2026-09-24 11:49 UTC -
web:security-tracker.debian.org
Vulnerable and fixed packages The table below lists information on source packages.
2026-09-24 11:49 UTC -
web:senserva.com
Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.
2026-09-24 11:49 UTC -
web:www.aikido.dev
CVE remediation is fixing known flaws in the software you run. Why upgrading often fails, what remediation actually involves, and how backporting fixes it.
2026-09-24 11:49 UTC -
web:www.cve.org
At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures
2026-09-24 11:49 UTC -
web:www.oracle.com
This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.
2026-09-24 11:49 UTC -
web:www.oracle.com
This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.
2026-09-24 11:49 UTC -
web:cvebrief.com
Remediation Immediate Action: Upgrade to Apache Tomcat versions 11.0.26, 10.1.60, or 9.0.122, which contain the necessary security fixes for this flaw. Proactive Monitoring: Review web server access logs for anomalous request patterns or unexpected successful authentication events originating from unknown sources.
2026-09-25 10:08 UTC -
web:msrc.microsoft.com
Security Update Guide - Microsoft Security Response Center
2026-09-25 10:08 UTC -
web:support.servicenow.com
What you need to know: On September 24, 2026 , ServiceNow issued CVE - 2026 -86857, CVE - 2026 -86858, CVE - 2026 -13016, CVE - 2026 -86859, and CVE - 2026 -86860. Each of these security issues was identified through
2026-09-25 10:08 UTC -
web:vulners.com
Apache Tomcat is vulnerable to a flaw where CLIENT_CERT authentication does not fail as expected in specific scenarios even when soft fail is disabled. This was caused by an incomplete fix for CVE - 2026 -34500 , where OCSP checks sometimes soft-fail...
2026-09-25 10:08 UTC -
web:www.cvefind.com
Full details for CVE-2026-86248 : technical description, impact, CVSS/EPSS scores, linked CWE, CAPEC, affected CPEs, disclosure date, and mitigation options.
2026-09-25 10:08 UTC -
web:www.rapid7.com
CVE-2026-86248 : Improper Authentication. View severity, references, and remediation details from Rapid7.
2026-09-25 10:08 UTC -
web:www.wiz.io
Understand the critical aspects of CVE - 2026 -86218 with a detailed vulnerability assessment, exploitation potential, affected technologies, and remediation guidance.
2026-09-25 10:08 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-86248.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86248",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T16:14:53.442167Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T16:14:59.897Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Tomcat",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "11.0.25",
"status": "affected",
"version": "11.0.0-M14",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.1.59",
"status": "affected",
"version": "10.1.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.0.121",
"status": "affected",
"version": "9.0.92",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mike Read (github.com/Michael-JRead)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat.</p><p>This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121.</p><p>Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.</p>"
}
],
"value": "CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T11:29:35.479Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/nmkmjp9l53y8h3oc4n8fc0bkw9dv15sk"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-86248",
"datePublished": "2026-09-23T11:29:35.479Z",
"dateReserved": "2026-09-06T10:25:16.193Z",
"dateUpdated": "2026-09-23T16:14:59.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}