CVE-2026-86246criticalCWE-1188

CVE-2026-86246: fallo crítico en Apache Tomcat Native

Apache Tomcat Native: Insecure OpenSSL options enabled

Publicada el

Seguir esta CVE+ Monitorear Apache Tomcat Native+ Monitorear tomcat-native

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.1epss 0.3%
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Productos afectados
Apache Software Foundation · Apache Tomcat Native
CVEs relacionadas — Apache Tomcat Native

En el mismo producto, de las más peligrosas a las menos.

CVE-2018-8020—CVE-2018-8020EPSS 4.2%CVE-2018-8019—CVE-2018-8019EPSS 4.0%CVE-2017-15698—CVE-2017-15698EPSS 3.5%CVE-2026-29145CRITICALApache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabledEPSS 0.7%CVE-2026-24734HIGHApache Tomcat Native, Apache Tomcat: OCSP revocation bypassEPSS 0.6%CVE-2026-86243HIGHApache Tomcat Native: DoS via TLS handshakeEPSS 0.6%