# CVE-2026-76183

Authentication bypass in Apache Tomcat WebSocket endpoints.

- Page: https://www.vulneraibility.com/cve/CVE-2026-76183
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.57% (percentile 47.3)
- Unvetted proof-of-concept code on GitHub: 1 GitHub proof of concept (first 2026-10-23)
- CISA SSVC: exploitation none, automatable yes, technical impact total (assessed 2026-09-23)
- Weakness: CWE-289
- Published: 2026-09-23

## Affected versions

- Apache Software Foundation Apache Tomcat: affected >= 11.0.0-M1 and <= 11.0.25; >= 10.1.0-M1 and <= 10.1.59; >= 9.0.0.M1 and <= 9.0.121; >= 8.5.0 and <= 8.5.100; >= 7.0.43 and <= 7.0.109; < 7.0.43

A version outside these ranges is not a statement that it is unaffected.

## Impact

Bypass WebSocket security constraints to access/operate protected endpoints, enabling unauthorized access, data exposure, and potential session misuse.

## Action

Immediate action required

## Recommendation

Upgrade to 11.0.26, 10.1.60 or 9.0.122 immediately

## References

- [advisory] https://lists.apache.org/thread/45mxk8nj2q8pkhct6lfxkvtm2jpywrsp
- [other] http://www.openwall.com/lists/oss-security/2026/09/23/21

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.