# CVE-2026-86248

Apache Tomcat CLIENT_CERT auth bypass permits unauthorized access.

- Page: https://www.vulneraibility.com/cve/CVE-2026-86248
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.50% (percentile 42.8)
- CISA SSVC: exploitation none, automatable yes, technical impact total (assessed 2026-09-23)
- Weakness: CWE-287
- Published: 2026-09-23

## Affected versions

- Apache Software Foundation Apache Tomcat: affected >= 11.0.0-M14 and <= 11.0.25; >= 10.1.22 and <= 10.1.59; >= 9.0.92 and <= 9.0.121

A version outside these ranges is not a statement that it is unaffected.

## Impact

Bypasses CLIENT_CERT authentication, allowing attackers to access protected resources and impersonate clients remotely.

## Action

Immediate action required

## Recommendation

Upgrade to Tomcat 11.0.26, 10.1.60, or 9.0.122 immediately.

## References

- [advisory] https://lists.apache.org/thread/nmkmjp9l53y8h3oc4n8fc0bkw9dv15sk

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.