PT-2026-57993 · Apache · Apache Tomcat

Ndix · Published 2026-07-14 · Updated 2026-07-14 · CVE-2026-59084

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.23 Apache Tomcat versions 10.1.0-M1 through 10.1.56 Apache Tomcat versions 9.0.13 through 9.0.119 Apache Tomcat versions 8.5.38 through 8.5.100 Apache Tomcat versions 7.0.100 through 7.0.109

Description Insufficient technical documentation regarding the requirements to securely configure the EncryptInterceptor component.

Recommendations Upgrade to version 11.0.24 Upgrade to version 10.1.57 Upgrade to version 9.0.120

Fix

Weakness Enumeration

CWE-1059

Related Identifiers

CVE-2026-59084

Affected Products

Apache Tomcat

References · 5

• https://lists.apache.org/thread/7w9746ootcxo0gvx26xjpw80l31f1qw7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-59084 · Security Note
• https://twitter.com/infoflowcloud/status/2076981473677099043 · Twitter Post
• https://twitter.com/CVEnew/status/2076980595876311280 · Twitter Post
• http://openwall.com/lists/oss-security/2026/07/14/8 · Note