Vulnerabilitymedium
CVE-2026-86247: Apache Tomcat Native: Client certificate requirements can be down-graded
AI summary · grok-4.7Summaries by Vani AI
Apache Tomcat Native CVE-2026-86247 can downgrade client-certificate checks via a race condition.
Mark Thomas disclosed CVE-2026-86247, a moderate-severity race condition in Apache Tomcat Native. Versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8 are affected, and unsupported releases may be as well. In some configurations, the flaw can downgrade client-certificate verification requirements. The notice does not report observed exploitation.
Key facts
- CVE-2026-86247 is rated moderate by the Tomcat project.
- Affects Tomcat Native 2.0.0-2.0.15 and 1.3.0-1.3.8.
- A race condition can weaken client-certificate checks in some setups.
- Unsupported versions may also be affected; no exploitation is reported.
- CVEs
- CVE-2026-86247
- Vendors
- Apache Software Foundation
- Products
- Apache Tomcat Native
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86247 | Race Condition in Apache Tomcat Native Weakens TLS Client Certificate Verification | 7.4 | — |
From the original article
Posted by Mark Thomas on Sep 23 Severity: moderate Affected versions: - Apache Tomcat Native 2. 0. 0 through 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.