Auth bypass in Apache Software Foundation Tomcat

CVE-2026-75973

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.

Vulnerability class: Broken Authentication

Published · last modified .

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.

EPSS exploit prediction

EPSS: 0.005 (44.1th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 44th percentile — 44.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-75973: held from 0.002 to 0.005.

EPSS over last 30 days · oldest: 0.002 · newest: 0.005 · change: +0.003

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-75973?
CVE-2026-75973 is a high-severity vulnerability in Apache Software Foundation Tomcat, classified under Improper Authentication. CVSS score: 7.3/10. Published 2026-09-23.
How severe is CVE-2026-75973?
High severity. CVSS v3 base score is 7.3 out of 10.