CVE-2026-53434
Published: 29 June 2026
Summary
CVE-2026-53434 is a critical-severity Detection of Error Condition Without Action (CWE-390) vulnerability in Apache Tomcat. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-40228
Vulnerability details
Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade…
more
to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CWE-390 error handling flaw in Tomcat CRL configuration for public-facing connectors directly enables remote exploitation of the server.
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requires explicit action (alert plus additional responses) on audit logging failures rather than detecting the error condition without acting.
The control mandates response actions to address results from monitoring and assessments, preventing detection of error conditions without subsequent corrective action.
Procedures require detection of error/incident conditions followed by defined response actions.
IR testing verifies that detected error conditions trigger appropriate response actions rather than being ignored.
The containment, eradication, and recovery steps ensure detected incidents trigger concrete actions rather than no response.
Provides assistance for handling incidents, ensuring detected error conditions lead to appropriate user actions rather than inaction.
Requires response actions to analysis of monitoring data, directly preventing detection of error conditions without follow-up action.
Reporting on security performance measures requires confirming that detected error conditions trigger appropriate actions rather than being ignored.