VulnSocial

CVE-2026-68569Disclosure(apache / tomcat)

LOWCVSS 8.1 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch apache tomcat systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

apache CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-287

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • tomcat

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-08-25); latest day: 2
  • 4 total mentions across 2 days

Affected systems

Vendors
apache
Products
tomcat

Deep dive

Activity timeline4 mentions / 2d
01122Mentions · 2026-08-25: 2Mentions · 2026-08-26: 2Patch / Workaround · 2026-08-26: 1Technical Details · 2026-08-25: 2Technical Details · 2026-08-26: 208-2508-26
Signal classification3 categories
Disclosure
250.0%
General
125.0%
Patch
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-08-252
Disclosure1General1
2026-08-262
Disclosure1Patch1
Full discourse4 posts
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    Apache Tomcat fixed 11 vulnerabilities on August 25, 2026, including auth bypass (CVE-2026-68569) and HTTP/2 DoS flaws. Update to 11.0.25 now. #ApacheTomcat #CyberSecurity #CVE #DenialOfService #Infosec https://securityonline.info/apache-tomcat-11-0-25-vulnerabilities/

    Post summary

    The post announces that Apache Tomcat has fixed 11 vulnerabilities, including an auth bypass and HTTP/2 DoS flaws, and advises updating to version 11.0.25 to mitigate the risk.

    01061461
    13.0K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-68569 Improper Authentication in Apache Tomcat Allows Non-Existent Users to Authenticate https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-68569

    Post summary

    The text announces CVE-2026-68569, detailing an improper authentication flaw in Apache Tomcat that permits non-existent users to authenticate.

    00000129
    4.1K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-68569 Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user… https://www.cve.org/CVERecord?id=CVE-2026-68569 ----- Traducción: CVE-2026-68569 Vul… https://infoflow.cloud`

    Post summary

    The post announces the CVE-2026-68569 improper authentication flaw in Apache Tomcat and links to the official CVE record.

    0000044
    102 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-68569 Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user… https://www.cve.org/CVERecord?id=CVE-2026-68569

    Post summary

    The post references CVE-2026-68569 as an improper authentication flaw in Apache Tomcat, noting specific contexts but offering minimal detail otherwise.

    000001.5K
    58.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapachetomcat---

Explore more

Back to dashboardapache CVEstomcat vulnerabilities