Critical severity · published Sep 23, 2026
CVE-2026-86246
Apache Tomcat Native: Insecure OpenSSL options enabled
9.1
CVSS
0.3%
EPSS
No
On KEV
Description
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
Apache Tomcat Native · Apache Software Foundation
2.0.0 through 2.0.15; 1.3.0 through 1.3.8 · source: vendor
TN
Tomcat Native · Apache
1.3.0 before 1.3.9; 2.0.0 before 2.0.16 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86246
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86246
Vendor Advisory
https://lists.apache.org/thread/dgyvfwb24nbk45ptvlhdyhdhl5o7k5ol
Mailing List
http://www.openwall.com/lists/oss-security/2026/09/23/32
More from Apache Tomcat Native
9.1
CVE-2026-29145
Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled
7.5
CVE-2026-86243
Apache Tomcat Native: DoS via TLS handshake
7.4
CVE-2026-86247
Apache Tomcat Native: Client certificate requirements can be down-graded