Apache Tomcat: 5,853,642 Fingerprint Matches and 10,191 Manager Pages

Two counts from one product

ZoomEye returns 5,853,642 matches for app="Apache-Tomcat", collected on 2026-09-24. Adding a title qualifier narrows it sharply: app="Apache-Tomcat" && title="Manager" returns 10,191.
That pair of numbers is one of the more useful comparisons available for a server platform. The estate is large, and the small subset that matches a management page title is the part with the shortest path to code execution.

Why the manager application matters

Tomcat ships a management web application that deploys and undeploys applications on the running server. The application is a deployment tool whose purpose is to place new code onto the host. Access to it is therefore equivalent to a deployment capability, which on most installations is equivalent to running code as the service account.
The project's own documentation is explicit about the exposure. Deploying the manager on a production host is discouraged unless there is a reason, and access controls are expected: a role-restricted user, a remote address filter, and removal of the sample applications that ship with the distribution.

Reading the two counts together

The 5,853,642 matches describe servers presenting a Tomcat signature. Most are ordinary application servers serving their intended audience, and that is a normal and unremarkable state.
The 10,191 that also present a manager page title are the interesting set. A management page visible to a scan suggests an interface that answers before authentication completes, and the value of the query is that it separates a small, actionable population from a large, unremarkable one. The count does not establish that any of those pages accepts a default credential, and no authentication was attempted.

What to check on an installation

Confirm which applications are deployed and remove the manager and host-manager applications from internet-facing instances. Where the manager is genuinely required, restrict it by source address using the address filter the project documents, and remove the default user definitions from the configuration file rather than assuming they were edited.
Review the deployment directory and the auto-deployment behaviour, since an interface that can write a web application archive also defines what runs next. Keep the server version current; the platform's advisory history includes remote code execution in the request parsing layer as well as in configuration handling.

Implications

Two queries on one product can be more informative than a single global total, because the comparison identifies which part of the estate carries the higher consequence. For Tomcat, that difference is the gap between serving content and accepting new code, and it is a gap worth measuring before it is discovered by someone else.

References

• ZoomEye search for app="Apache-Tomcat": https://www.zoomeye.ai/
• Apache Tomcat manager application documentation: https://tomcat.apache.org/tomcat-10.1-doc/manager-howto.html