Summary
Apache Tomcat addressed a critical vulnerability (CVE-2026-65182) that allows unauthenticated attackers to bypass security restrictions by exploiting path-ordering logic. Administrators should update to the latest versions or remove the examples application to prevent unauthorized access.
Take Action:
If you run Apache Tomcat (versions 9.0.x, 10.1.x, or 11.0.x), update now to 11.0.25, 10.1.59, or 9.0.121. Note that 10.1.58 has the fix but was never officially released, so don't rely on it. If you can't patch right away, delete the default examples web application and review your security constraint rules so the more restrictive short paths are listed before longer ones.
Read the full article on BeyondMachines
This article was originally published on BeyondMachines
Top comments (0)