The version of Tomcat installed on the remote host is prior to 10.1.60. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_10.1.60_security-10 advisory.

  - CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled     vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from     10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26,     10.1.60 or 9.0.122, which fix the issue. (CVE-2026-86248)

  - Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an     unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1     through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be     affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be     affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78383)

  - Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM     TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from     11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121. The following     versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through     8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version     11.0.26, 10.1.59, 9.0.122, which fixes the issue. (CVE-2026-73581)

  - Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with     SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the     realm for the first web application to authenticate a request would be used for all web applications. This     issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4     through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be     affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are     recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue. (CVE-2026-75973)

  - Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints     for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through     11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at     the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through     7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version     11.0.26, 10.1.60 or 9.0.122, which fix the issue. (CVE-2026-76183)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 11.0.26. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_11.0.26_security-11 advisory.

  - CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled     vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from     10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26,     10.1.60 or 9.0.122, which fix the issue. (CVE-2026-86248)

  - Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an     unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1     through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be     affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be     affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78383)

  - Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM     TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from     11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121. The following     versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through     8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version     11.0.26, 10.1.59, 9.0.122, which fixes the issue. (CVE-2026-73581)

  - Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with     SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the     realm for the first web application to authenticate a request would be used for all web applications. This     issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4     through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be     affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are     recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue. (CVE-2026-75973)

  - Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints     for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through     11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at     the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through     7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version     11.0.26, 10.1.60 or 9.0.122, which fix the issue. (CVE-2026-76183)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3165 advisory.

    Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM     TLS implementations ignore CRLs when certificate uses a keystore.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from     9.0.0-M1 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.
    (CVE-2026-73581)

    Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with     SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the     realm for the first web application to authenticate a request would be used for all web applications.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M4 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.
    (CVE-2026-75973)

    Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints     for any WebSocket endpoint to be bypassed.



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M1 through 9.0.121.



    The following versions were EOS at the time the CVE was created but areknown to be affected: from 8.5.0     through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-76183)

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache     Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to     cause one request from another user to fail when Tomcat is located behind a reverse proxy.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.47 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.67     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-77756)

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability     in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.39 through 9.0.121.

    The following versions were EOL at the time the CVE was created but areknown to be affected: from 8.5.59     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue.
    (CVE-2026-77762)

    Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message     enabled a DoS attack.

    This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74     through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.88     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-77791)

    Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an     unauthenticated AJP request to pin an AJP processing thread leading to denial of service.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M1 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78383)

    Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on     timing) cause one request from another user to fail.

    This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116     through 9.0.121.

    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78437)

    Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in     Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M1 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-79677)

    CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled     vulnerability in Apache Tomcat.



    This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from     9.0.92 through 9.0.121.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-86248)

    Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache     Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up.



    This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118     through 9.0.121.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-86350)

    Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket     message smuggling when per-message-deflate is used.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M1 through 9.0.121.

    The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100, from 7.0.56 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.1.22, which fix the issue.
    (CVE-2026-87022)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache     Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue     affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through     9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-86350)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
349470	Apache Tomcat 10.1.0.M1 < 10.1.60 multiple vulnerabilities	Nessus	Web Servers	2026/9/23	2026/10/26	critical
349471	Apache Tomcat 11.0.0.M1 < 11.0.26 multiple vulnerabilities	Nessus	Web Servers	2026/9/23	2026/10/26	critical
363073	SUSE SLES16: libtcnative-1-0 / libtcnative-2-0 / tomcat / tomcat-admin-webapps / etc (SUSE-SU-2026:23985-1)	Nessus	SuSE Local Security Checks	2026/10/6	2026/10/26	critical
365216	Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2026-3165)	Nessus	Amazon Linux Local Security Checks	2026/10/12	2026/10/26	critical
349585	Linux Distros Unpatched Vulnerability : CVE-2026-86350	Nessus	Misc.	2026/9/24	2026/11/5	critical

検出

プラグインの検索

critical

critical

critical

critical

critical