High severity · published Sep 23, 2026
CVE-2026-86247
Apache Tomcat Native: Client certificate requirements can be down-graded
7.4
CVSS
0.2%
EPSS
No
On KEV
Description
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
Apache Tomcat Native · Apache Software Foundation
2.0.0 through 2.0.15; 1.3.0 through 1.3.8 · source: vendor
TN
Tomcat Native · Apache
1.3.0 before 1.3.9; 2.0.0 before 2.0.16 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86247
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86247
Vendor Advisory
https://lists.apache.org/thread/obsson6zhvfg0wsp2bx602l61ltj87r1
Mailing List
http://www.openwall.com/lists/oss-security/2026/09/23/33
More from Apache Tomcat Native
9.1
CVE-2026-86246
Apache Tomcat Native: Insecure OpenSSL options enabled
9.1
CVE-2026-29145
Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled
7.5
CVE-2026-86243
Apache Tomcat Native: DoS via TLS handshake