Skip to content
NewA calmer, faster ZeroHour
Vulnerability2

CVE-2026-55957

CVSS 3.1
7.3 high
EPSS
3%p86
Published
·
Modified
Analyze CVE-2026-55957 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Vendors
apache
Products
tomcat
Weakness
CWE-304
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD CVE.org GitHub PoCs EPSS (2.9%)

In the news

1 story