Cyber Resilience

CVE-2026-43512

Apache Tomcat 7.0.0 – 7.0.109

Published
12 May 2026
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.013 70th percentile
Risk Priority 74 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-43512 is a critical-severity DEPRECATED: Authentication Bypass Issues (CWE-592) vulnerability in Apache Tomcat. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 30% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older unsupported versions any also…

more

be affect Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

CWE(s)
CWE-592

Related Threats

CVEs Like This One

CVE-2026-55957Same product: Apache Tomcat
CVE-2026-68525Same product: Apache Tomcat
CVE-2025-55752Same product: Apache Tomcat
CVE-2025-31650Same product: Apache Tomcat
CVE-2025-48989Same product: Apache Tomcat
CVE-2026-25854Same product: Apache Tomcat
CVE-2026-66422Same product: Apache Tomcat
CVE-2026-53434Same product: Apache Tomcat
CVE-2025-52434Same product: Apache Tomcat
CVE-2026-34487Same product: Apache Tomcat

Affected Assets

apache
tomcat
7.0.0 — 7.0.109 · 8.5.0 — 8.5.100 · 9.0.0 — 9.0.118

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References