What’s Vulnerable › Vulnerabilities
CVE-2026-86248: Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-23 · updated 2026-09-23
- Weakness: CWE-287
Description
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Affected products
- Apache Tomcat: from 11.0.0-M14 through 11.0.25; from 10.1.22 through 10.1.59; from 9.0.92 through 9.0.121
References
Get alerted when CVE-2026-86248 or the next vulnerability affects your stack