CVE-2026-86246 Apache Tomcat Native: Insecure OpenSSL options enabled
Apache Tomcat Native enables insecure OpenSSL options by default, allowing attackers to bypass security controls; users should upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-86246?
CVE-2026-86246 is a critical vulnerability in Apache Tomcat Native, published on 23 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.
Weakness: CWE-1188
Which versions are affected by CVE-2026-86246?
It affects 1 product.
Products include Apache Tomcat Native.
How do I fix CVE-2026-86246?
Upgrade to a fixed version.
Is CVE-2026-86246 being exploited?
There is no known exploitation of CVE-2026-86246 in the wild and no public exploit code.
Other vulnerabilities in Apache Tomcat Native
- CVE-2026-86243 Apache Tomcat Native: DoS via TLS handshake
- CVE-2026-86247 Apache Tomcat Native: Client certificate requirements can be down-graded
- CVE-2018-8019 Auth bypass in Apache Tomcat Native
- CVE-2018-8020 Auth bypass in Apache Tomcat Native
- CVE-2017-15698 Security feature bypass in Apache Tomcat Native
Sources
Also known as DEBIAN-CVE-2026-86246, GHSA-9p2m-jvmj-wh8q, MINI-r3v9-xw8g-h932, UBUNTU-CVE-2026-86246.