CVE-2026-74049
Received
Received - Intake
Execution After Redirect in Apache Tomcat
Vulnerability report for CVE-2026-74049, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-20
Last updated on: 2026-10-20
Assigner: Apache Software Foundation
Description
Description
Execution After Redirect (EAR) vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Apache | Software | Foundation Apache Tomcat 11.0.0-M1 |
| Apache | Software | Foundation Apache Tomcat 10.1.0-M1 |
| Apache | Software | Foundation Apache Tomcat 9.0.0.M1 |
| Apache | Software | Foundation Apache Tomcat 8.5.0 |
| Apache | Software | Foundation Apache Tomcat 7.0.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-698 | The web application sends a redirect to another location, but instead of exiting, it executes additional code. |
