CVE-2026-86246
Received Received - Intake

Insecure Default Options in Apache Tomcat Native

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: Apache Software Foundation

Description
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-86246
EUVD
EUVD-2026-85268

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
apache tomcat_native From 2.0.0 (inc) to 2.0.15 (inc)
apache tomcat_native From 1.3.0 (inc) to 1.3.8 (inc)
apache tomcat_native 2.0.16
apache tomcat_native 1.3.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1188 The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Apache Tomcat Native initializing resources with insecure default settings. These settings include enabling ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF, and ALLOW_NO_DHE_KEX, which could expose systems to man-in-the-middle attacks or weaken encryption.

Detection Guidance

Check the version of Apache Tomcat Native installed on your system. If it falls within the affected ranges (2.0.0-2.0.15 or 1.3.0-1.3.8), the system is vulnerable. Use commands like 'find / -name tomcat-native*' or check package managers (e.g., 'dpkg -l | grep tomcat-native' for Debian/Ubuntu).

Impact Analysis

The vulnerability may allow attackers to intercept or manipulate encrypted communications, leading to data breaches or unauthorized access. Systems using affected versions of Apache Tomcat Native could be at risk of security failures.

Compliance Impact

This vulnerability enables insecure TLS options by default, which could weaken encryption and expose sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health data security) by failing to implement strong encryption standards.

Mitigation Strategies

Upgrade Apache Tomcat Native to version 2.0.16 or 1.3.9 or later. If using a package manager, run commands like 'apt-get update && apt-get upgrade tomcat-native' or 'yum update tomcat-native' depending on your system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86246. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart