CVE-2026-75973: Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured | LiveThreat CVE Feed — Verisq

Login Request a demo

High severity · published Sep 23, 2026

CVE-2026-75973

Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured

7.3

CVSS

0.5%

EPSS

No

On KEV

Description

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

Low

Integrity

Low

Availability

Low

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 44% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

TO

Tomcat · Apache

11.0.0-M1 through 11.0.25; 10.1.0-M1 through 10.1.59; 9.0.0.M4 through 9.0.121; 8.5.0 through 8.5.100 · source: vendor

Affected product

TO

Tomcat

Apache

All Tomcat CVEs

References

https://nvd.nist.gov/vuln/detail/CVE-2026-75973

https://www.cve.org/CVERecord?id=CVE-2026-75973

lists.apache.org

https://lists.apache.org/thread/njjcdkkzqyzx4n3ffc4ffjmyh5mpl1gr

www.openwall.com

http://www.openwall.com/lists/oss-security/2026/09/23/20

More from Tomcat

9.8

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

9.8

Apache Tomcat Improper Privilege Management Vulnerability

9.8

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…

8.1

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g

8.1

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g