Cyber Resilience

CVE-2026-43512

Critical

Published: 12 May 2026

Published
12 May 2026
Modified
15 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0123 65.3th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-43512 is a critical-severity DEPRECATED: Authentication Bypass Issues (CWE-592) vulnerability in Apache Tomcat. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 34.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older unsupported versions any also…

more

be affect Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

CWE(s)
CWE-592

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Authentication bypass in public-facing Apache Tomcat web server directly enables exploitation of public-facing applications for initial access.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-41293Same product: Apache Tomcat
CVE-2025-55754Same product: Apache Tomcat
CVE-2026-34486Same product: Apache Tomcat
CVE-2026-42498Same product: Apache Tomcat
CVE-2026-24880Same product: Apache Tomcat
CVE-2025-66614Same product: Apache Tomcat
CVE-2026-29146Same product: Apache Tomcat
CVE-2026-34483Same product: Apache Tomcat
CVE-2026-29129Same product: Apache Tomcat
CVE-2026-29145Same product: Apache Tomcat

Affected Assets

apache
tomcat
7.0.0 — 7.0.109 · 8.5.0 — 8.5.100 · 9.0.0 — 9.0.118

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References