CVE-2026-65182

Analyzed Analyzed - Analysis Complete

Improper Access Control in Apache Tomcat

Publication date: 2026-08-25

Last updated on: 2026-08-27

Assigner: Apache Software Foundation

Description

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-27

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-65182

EUVD

EUVD-2026-66124

Affected Vendors & Products

Vendor	Product	Version / Range
apache	tomcat	From 7.0.0 (inc) to 7.0.109 (inc)
apache	tomcat	From 10.1.0 (inc) to 10.1.58 (exc)
apache	tomcat	From 11.0.0 (inc) to 11.0.25 (exc)
apache	tomcat	From 8.5.0 (inc) to 9.0.121 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This is an Improper Access Control vulnerability in Apache Tomcat where security constraints can be bypassed if a longer path constraint is defined before a more restrictive one for a shorter sub-path. This allows unauthorized access to protected resources.

Detection Guidance

This vulnerability can be detected by checking the Apache Tomcat version installed on your system. If it falls within the affected versions (11.0.0-M1 to 11.0.24, 10.1.0-M1 to 10.1.57, 9.0.0.M1 to 9.0.120, 8.5.0 to 8.5.100, or 7.0.0 to 7.0.109), it is vulnerable. Use commands like 'catalina.sh version' or 'systemctl status tomcat' to check the version.

Impact Analysis

An attacker could exploit this to bypass security restrictions and access sensitive data or perform unauthorized actions on affected Apache Tomcat servers. Systems running vulnerable versions are at risk.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating compliance requirements for data protection standards like GDPR and HIPAA, which mandate strict access controls and data security measures.

Mitigation Strategies

Upgrade Apache Tomcat to the latest fixed versions: 11.0.25, 10.1.58, 9.0.121, or later. Check your current Tomcat version with 'catalina.sh version' or 'tomcat9 version' and compare against affected ranges.

Hi! I’m here to help you understand CVE-2026-65182. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70