CVE-2026-65182General(apache / tomcat)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch apache tomcat systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.

apache CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-284CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

tomcat

Threat summary

Patch or workaround signal is available
6 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
General: 3 classified signals
Disclosure: 1 classified signal
Peaked 3d ago at 2 mentions (2026-08-29); latest day: 1
6 total mentions across 5 days

Affected systems

Vendors

apache

Products

tomcat

Deep dive

Activity timeline6 mentions / 5d

Signal classification3 categories

General

360.0%

Patch

120.0%

Disclosure

120.0%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-28	1	General1
2026-08-29	2	General1Patch1
2026-08-30	1	General1
2026-08-31	1	Disclosure1

Full discourse6 posts

ゆぅさん@YY2042427743d
Disclosure
【3軸解説】「Apache Tomcatにおける複数の脆弱性(2026年8月25日)（CVE-2026-65182）」を、背景 / 目的 / 効果の 3 軸で読み解きます。背景/目的/効果の3軸で読み解きました。 #セキュリティ #若手コンサル ▶ 実践教材(BOOTH): https://www.intect-i.jp/go/booth/?utm_source=sns&utm_medium=social&utm_campaign=booth
Post summary
The post offers a high‑level discussion of the Apache Tomcat CVE‑2026‑65182 vulnerability, covering background, purpose, and impact, but provides no PoC, exploit code, active exploitation evidence, patch information, or technical details.
00020103
844 followersView on X
ゆぅさん@YY2042427744d
General
もし自分の現場で「Apache Tomcatにおける複数の脆弱性(2026年8月25日)（CVE-2026-65182）」が起きたら、最初の一手は何ですか? →背景/目的/効果の3軸でfirst-stepを整理しました。 #セキュリティ #インシデント対応 ▶ 無料トレーニング: https://www.intect-i.jp/training/free/?utm_source=sns&utm_medium=social&utm_campaign=free_training
Post summary
The tweet poses a general incident‑response question for CVE‑2026‑65182 without sharing PoC, exploit, active‑attack, patch, or detailed vulnerability information.
0001086
843 followersView on X
ゆぅさん@YY2042427745d
General
「Apache Tomcatにおける複数の脆弱性(2026年8月25日)（CVE-2026-65182）」をボードに上げるなら1ページでどう書く? 背景/目的/効果の3軸で要約しました。 #セキュリティ #経営報告 ▶ note道場 (月1,280円・初月無料): https://www.intect-i.jp/go/dojo/?utm_source=sns&utm_medium=social&utm_campaign=dojo
Post summary
The post merely poses a question about summarizing a Tomcat vulnerability (CVE‑2026‑65182) for a board, without providing technical, exploit, or remedial details.
00010203
841 followersView on X
DailyCVE@dailycve5d
🔵 Apache Tomcat, Security Constraint Bypass, #CVE-2026-65182 (Important) -DC-Oct2026-2910 https://dailycve.com/apache-tomcat-security-constraint-bypass-cve-2026-65182-important-dc-oct2026-2910/
0000036
241 followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker45d
Patch
【重要】Apache TomcatにCVSS 9.1、アクセス制御回避を修正 https://www.cybernote.click/2026/08/29/apache-tomcat-cve-2026-65182-security-constraint-bypass/ #IT #Security #cybersecurity
Post summary
The post announces a patch for CVE‑2026‑65182 in Apache Tomcat, noting a CVSS score of 9.1 and that the vulnerability involves an access‑control bypass.
0000068
203 followersView on X
ゆぅさん@YY2042427746d
General
【3軸解説】「Apache Tomcatにおける複数の脆弱性(2026年8月25日)（CVE-2026-65182）」を、背景 / 目的 / 効果の 3 軸で読み解きます。背景/目的/効果の3軸で読み解きました。 #セキュリティ #若手コンサル ▶ 無料ツール WR-Analysis: https://www.intect-i.jp/tools/wr-analysis/?utm_source=sns&utm_medium=social&utm_campaign=wr_analysis
Post summary
The post offers a conceptual 3‑axis overview of Tomcat vulnerabilities (CVE‑2026‑65182) without providing technical details, PoC, exploit code, or mitigation information.
0000073
841 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	tomcat	-	-	-

Explore more

Back to dashboard apache CVEs tomcat vulnerabilities

What researchers are saying

CVE-2026-65182

ゆぅさん[verified]@YY20424277Disclosure

The post offers a high‑level discussion of the Apache Tomcat CVE‑2026‑65182 vulnerability, covering background, purpose, and impact, but provides no PoC, exploit code, active exploitation evidence, patch information, or technical details.

ゆぅさん[verified]@YY20424277General

The tweet poses a general incident‑response question for CVE‑2026‑65182 without sharing PoC, exploit, active‑attack, patch, or detailed vulnerability information.

ゆぅさん[verified]@YY20424277General

The post merely poses a question about summarizing a Tomcat vulnerability (CVE‑2026‑65182) for a board, without providing technical, exploit, or remedial details.

ゆぅさん[verified]@YY20424277General

The post offers a conceptual 3‑axis overview of Tomcat vulnerabilities (CVE‑2026‑65182) without providing technical details, PoC, exploit code, or mitigation information.

ケイ | IT・セキュリティ系副業Webライター@Teeeda_workerPatch

The post announces a patch for CVE‑2026‑65182 in Apache Tomcat, noting a CVSS score of 9.1 and that the vulnerability involves an access‑control bypass.