CVE-2026-86248Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

9.8CriticalCVSS base score
0.50%Exploitation in 30 daysEPSS · top 57% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

Timeline

2026
6 Sept 2026
6 Sept 2026
ID reserved
By apache
23 Sept 202617 days later
23 Sept 2026· 17 days later
Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-86248, by who scored it
Scored by	CVSS	Score	Vector
CISA-ADPADP (enrichment)	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Awaiting Analysis	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.50% · top 57% of all CVEs (15 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Affected products

Apache Software Foundation · Apache Tomcat
- affected 11.0.0-M14 – ≤ 11.0.25
- affected 10.1.22 – ≤ 10.1.59
- affected 9.0.92 – ≤ 9.0.121

References1

https://lists.apache.org/thread/nmkmjp9l53y8h3oc4n8fc0bkw9dv15sk (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-86248](https://cveledger.app/badge/CVE-2026-86248.svg)](https://cveledger.app/cve/CVE-2026-86248)

Record last updated 23 Sept 2026, 16:14 UTC.