CVE-2026-86247 — HIGH (7.4)

Q: How severe is CVE-2026-86247?

CVE-2026-86247 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-86247?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Tomcat Native.

Vulnerability Description

Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.

CVSS Score

7.4

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Apache	Tomcat Native	>= 1.3.0, < 1.3.9

Related Weaknesses (CWE)

CWE-366

References

https://lists.apache.org/thread/obsson6zhvfg0wsp2bx602l61ltj87r1Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/09/23/33Mailing ListThird Party Advisory

FAQ

What is CVE-2026-86247?

CVE-2026-86247 is a vulnerability with a CVSS score of 7.4 (HIGH). Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat...

How severe is CVE-2026-86247?

CVE-2026-86247 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-86247?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Tomcat Native.