KLA91234 SB vulnerabilities in Apache Tomcat

🗓️ 18 Aug 2026 00:00:00Reported by Kaspersky LabType

kaspersky🔗 threats.kaspersky.com👁 65 Views

Security bypass in Apache Tomcat before 9.0.121 via HTTP/2 handling and security constraints.

Reporter	Title	Published	Views	Family All 580
IBM Security Bulletins	Security Bulletin: IBM ApplinX is vulnerable to multiple issues like improper Access control, Authentication Bypass, Improper Authorization and more due to the use of Apache-Tomcat .	22 Sep 202612:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms.	9 Sep 202609:46	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	5 Oct 202608:14	–	ibm
IBM Security Bulletins	Security Bulletin: DEV-EXT - tomcat-embed-core-10.1.57.jar (Publicly disclosed vulnerability found by Scanner)	17 Sep 202620:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities	28 Sep 202606:43	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Tomcat (tomcat-embed-websocket) ‚Äî Insufficient Session Expiration via WebSocket	17 Sep 202620:19	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	1 Oct 202610:16	–	ibm
attackerkb	CVE-2026-66299	28 Jul 202614:29	–	attackerkb
Tenable Nessus	Amazon Linux 2 : tomcat, --advisory ALAS2TOMCAT9-2026-028 (ALASTOMCAT9-2026-028)	31 Aug 202600:00	–	nessus
Tenable Nessus	openSUSE 16: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (openSUSE-SU-2026:21810-1)	11 Sep 202600:00	–	nessus

Source	Link
tomcat	www.tomcat.apache.org/security-9.html
threats	www.threats.kaspersky.com/en/product/Apache-Tomcat/
statistics	www.statistics.securelist.com/

27 Aug 2026 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.15.3 - 9.8

EPSS0.00745

SSVC

Apache Tomcat security bypass HTTP/2 handling security constraints critical severity multiple CVEs