Cyber Resilience

CVE-2026-43512

Apache Tomcat 7.0.0 – 7.0.109

Published
12 May 2026
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.012 66th percentile
Risk Priority 74 floored blend · peak EPSS

Summary

CVE-2026-43512 is a critical-severity DEPRECATED: Authentication Bypass Issues (CWE-592) vulnerability in Apache Tomcat. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 34% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older unsupported versions any also…

more

be affect Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

CWE(s)
CWE-592

Related Threats

CVEs Like This One

CVE-2026-66299Same product: Apache Tomcat
CVE-2026-25854Same product: Apache Tomcat
CVE-2024-21733Same product: Apache Tomcat
CVE-2026-55955Same product: Apache Tomcat
CVE-2025-49125Same product: Apache Tomcat
CVE-2026-55956Same product: Apache Tomcat
CVE-2026-34500Same product: Apache Tomcat
CVE-2025-52434Same product: Apache Tomcat
CVE-2025-66614Same product: Apache Tomcat
CVE-2026-55957Same product: Apache Tomcat

Affected Assets

apache
tomcat
7.0.0 — 7.0.109 · 8.5.0 — 8.5.100 · 9.0.0 — 9.0.118

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References