CVE-2026-43512: Apache Tomcat: Digest authenticator will authenticate any unknown user

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-12 · updated 2026-10-26
Weakness: CWE-592

Description

DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older unsupported versions any also be affect Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

Summary

Apache Tomcat's deprecated Digest authenticator can authenticate any unknown user, creating an authentication bypass (CVSS 9.8, critical). Affected versions are 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and versions before 7.0.0; older unsupported versions may also be affected. There is no evidence of active exploitation (not in CISA KEV, SSVC exploitation: none; EPSS 1.3%). Upgrade to 11.0.22, 10.1.55, or 9.0.118 to fix the issue.

تسمح أداة المصادقة Digest المهجورة في Apache Tomcat بمصادقة أي مستخدم غير معروف، ما يؤدي إلى تجاوز المصادقة (CVSS 9.8، حرجة). تشمل الإصدارات المتأثرة 11.0.0-M1 حتى 11.0.21، و10.1.0-M1 حتى 10.1.54، و9.0.0.M1 حتى 9.0.117، و8.5.0 حتى 8.5.100، والإصدارات الأقدم من 7.0.0، وقد تتأثر أيضاً الإصدارات القديمة غير المدعومة. لا توجد أدلة على استغلال نشط (غير مدرجة في CISA KEV، وحالة الاستغلال وفق SSVC: none، واحتمال EPSS 1.3%). يُنصح بالترقية إلى 11.0.22 أو 10.1.55 أو 9.0.118 لإصلاح المشكلة.

Affected products

Apache Tomcat: from 7.0.0 through 7.0.109; from 8.5.0 through 8.5.100; from 9.0.0 before 9.0.118; from 10.1.0 before 10.1.55; from 11.0.0 before 11.0.22 — fixed in 9.0.118, 10.1.55, 11.0.22

How to fix

Upgrade to a fixed version: Apache Tomcat 9.0.118, 10.1.55, 11.0.22. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-43512 or the next vulnerability affects your stack