CVE-2026-75973
Received Received - Intake

Improper Authentication in Apache Tomcat

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: Apache Software Foundation

Description
Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-75973
EUVD
EUVD-2026-85224

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
apache tomcat From 11.0.0-M1 (inc) to 11.0.25 (inc)
apache tomcat From 10.1.0-M1 (inc) to 10.1.59 (inc)
apache tomcat From 9.0.0.M4 (inc) to 9.0.121 (inc)
apache tomcat From 8.5.0 (inc) to 8.5.100 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication is configured with SimpleAuthConfigProvider as the default provider and multiple web applications use that provider, the realm for the first web application to authenticate a request is incorrectly used for all web applications.

Detection Guidance

To detect this vulnerability, check if your Apache Tomcat version falls within the affected ranges (11.0.0-M1 to 11.0.25, 10.1.0-M1 to 10.1.59, 9.0.0.M4 to 9.0.121, or 8.5.0 to 8.5.100). Use commands like 'catalina.sh version' or 'docker exec <container> catalina.sh version' to verify the version.

Impact Analysis

This vulnerability could allow unauthorized access to web applications if an attacker exploits the shared authentication realm. Sensitive data in one application might be exposed to users of another application due to incorrect authentication handling.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating confidentiality requirements in GDPR and HIPAA. Non-compliance may result in legal penalties, data breach notifications, and reputational damage.

Mitigation Strategies

Upgrade Apache Tomcat to version 11.0.26, 10.1.60, or 9.0.122, depending on your current version. If using an unsupported version like 8.5.x, upgrade to a supported release or apply vendor patches immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75973. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart