CVE-2026-86247
published 2026-09-23CVE-2026-86247: Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some…
PriorityP347high7.4CVSS 3.1
AVNACHPRNUINSUCHIHAN
EPSS
0.22%
11.5th percentile
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat_native | >= 1.3.0 < 1.3.9 | 1.3.9 |
| apache | tomcat_native | >= 2.0.0 < 2.0.16 | 2.0.16 |
| apache_software_foundation | apache_tomcat_native | 1.3.0 – 1.3.8 | — |
| apache_software_foundation | apache_tomcat_native | 2.0.0 – 2.0.15 | — |
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_redhat7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition
vendor_redhat·2026-09-23·CVSS 7.4
CVE-2026-86247 [HIGH] CWE-366 tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition
tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.
A flaw was found in Apache Tomcat Native. A race condition within a thread allows client certificate verification requirements to be down-graded for certain configurations. This could enable an attacker to bypass stricter authentication requirements, potentially leading to unauthorized acces
GHSA
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.
ghsa_unreviewed·2026-09-23
CVE-2026-86247 [HIGH] CWE-366 Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-86247 tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition [epel-all]
bugzilla·2026-09-29·CVSS 7.4
CVE-2026-86247 [HIGH] CVE-2026-86247 tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition [epel-all]
CVE-2026-86247 tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.
Bugzilla
CVE-2026-86247 tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition [fedora-all]
bugzilla·2026-09-29·CVSS 7.4
CVE-2026-86247 [HIGH] CVE-2026-86247 tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition [fedora-all]
CVE-2026-86247 tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.
Bugzilla
CVE-2026-86247 tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition
bugzilla·2026-09-23·CVSS 7.4
CVE-2026-86247 [HIGH] CVE-2026-86247 tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition
CVE-2026-86247 tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.
2026-09-23
Published