In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application

Summary

In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.

Timeline

1. Aug 10, 2017, 4:00 PM UTCCVE published
2. Oct 8, 2026, 9:05 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: total

3. Oct 8, 2026, 9:13 PM UTCRecord last updated
4. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache Tomcat

  9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45

• org.apache.tomcat:tomcat-jasperMaven

  From 9.0.0.M1 · fixed in 9.0.0.M10

• org.apache.tomcat:tomcat-jasperMaven

  From 8.5.0 · fixed in 8.5.5

• org.apache.tomcat:tomcat-jasperMaven

  From 8.0.0RC1 · fixed in 8.0.37

• org.apache.tomcat:tomcat-jasperMaven

  From 7.0.0 · fixed in 7.0.72

• org.apache.tomcat:jasperMaven

  From 6.0.0 · fixed in 6.0.47

• org.apache.tomcat.embed:tomcat-embed-jasperMaven

  From 9.0.0.M1 · fixed in 9.0.0.M10

• org.apache.tomcat.embed:tomcat-embed-jasperMaven

  From 8.5.0 · fixed in 8.5.5

• org.apache.tomcat.embed:tomcat-embed-jasperMaven

  From 8.0.0RC1 · fixed in 8.0.37

• org.apache.tomcat.embed:tomcat-embed-jasperMaven

  From 7.0.0 · fixed in 7.0.72

• org.apache.tomcat.embed:tomcat-embed-jasperMaven

  From 6.0.0 · fixed in 6.0.47

References 25