CVE-2026-86248

Apache Tomcat's CLIENT_CERT (mutual TLS) authentication can fail open during certificate revocation checking: in some scenarios, OCSP checks performed via the FFM (Foreign Function & Memory) API soft-fail — treating an unverifiable or failed revocation check as passing — even when the administrator has explicitly disabled soft-fail. This is an incomplete fix for CVE-2026-34500. An attacker holding a revoked client certificate could present it to a protected application and still be authenticated, defeating the intended hard-fail policy and gaining whatever access that certificate's identity is authorized for. Only deployments using client-certificate authentication with OCSP revocation checking and soft-fail disabled are affected; standard deployments without mTLS or without revocation checks are not. No CVSS score has been assigned, no public proof of concept exists, and the issue is not in the CISA KEV catalog, so exploitation is not known to be occurring.

What to do: Upgrade to Apache Tomcat 11.0.26, 10.1.60, or 9.0.122 depending on your branch. If immediate patching is not possible, audit connectors using client-certificate authentication: verify whether OCSP soft-fail is disabled and whether the FFM-based OCSP path is in use, and consider adding CRL-based revocation checking as a compensating control. Review authentication logs for successful client-cert logins during OCSP responder outages or errors, since those are the sessions most likely to have bypassed the intended policy.