HIGHFixed upstream

CVE-2026-86247

Apache Tomcat Native: client certificate requirements can be downgraded

Technology

Apache Tomcat Native

CVSS Score

7.4 / 10.0

Affected Versions

Tomcat Native 2.0.0 to 2.0.15; 1.3.0 to 1.3.8; unsupported versions may also be affected

Upstream Fix

Tomcat Native 2.0.16; 1.3.9

Published

September 23, 2026

OSSeva Coverage

Fixed upstream

Description

A race condition allowed client certificate verification requirements to be downgraded in some configurations. Made public on 23 September 2026 and rated Important by the Tomcat security team. Fixed in Tomcat Native 2.0.16 and 1.3.9.

Upstream record: NVD · CVE.org

Is your Apache Tomcat Native deployment affected?

If you're running Tomcat Native 2.0.0 to 2.0.15; 1.3.0 to 1.3.8; unsupported versions may also be affected, you need this patch. Book a discovery call to get covered.

Book a discovery call View Apache Tomcat Native coverage →

Get a quote

Running Apache Tomcat Native Tomcat Native 2.0.0 to 2.0.15; 1.3.0 to 1.3.8; unsupported versions may also be affected?

Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.

Prefer to talk or read more first?

Book a 15-minute call Apache Tomcat Native support