Is CVE-2026-68525 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-68525 being exploited in the wild.

How severe is CVE-2026-68525?

Critical severity, with a CVSS score of 9.1, published 25 August 2026.

Which products and versions are affected?

Apache Tomcat 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0-M1-9.0.120, 10.1.0-M1-10.1.57, 11.0.0-M1-11.0.24; Apache Tomcat-Embed-Core 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0-M1-9.0.120, 10.1.0-M1-10.1.57, 11.0.0-M1-11.0.24; org.apache.tomcat:tomcat (Maven) ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.25; org.apache.tomcat:tomcat-catalina (Maven) ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.25; and 1 more.

Is there a fix for CVE-2026-68525?

Yes. org.apache.tomcat:tomcat (Maven): upgrade to 11.0.25 or later; org.apache.tomcat:tomcat-catalina (Maven): upgrade to 11.0.25 or later; org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 11.0.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-68525 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-68525?

Check whether you run Apache Tomcat, Apache Tomcat-Embed-Core, org.apache.tomcat:tomcat (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-68525: Apache Tomcat FORM authentication authorization bypass

CVE-2026-68525 · Severity: critical · CVSS 9.1 · Published 2026-08-25

Apache Tomcat's FORM authentication mechanism contains a flaw that allows attackers to bypass access controls on protected resources. An attacker can access resources that should only be available via POST requests by using GET requests instead, potentially exposing sensitive data or allowing unauthorized modifications. This affects a core security component relied upon by organizations worldwide to protect their web applications.

Technologies: Apache Tomcat, Apache Tomcat-Embed-Core, org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-catalina (Maven), org.apache.tomcat.embed:tomcat-embed-core (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2026-68525 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-68525 being exploited in the wild.
How severe is CVE-2026-68525?: Critical severity, with a CVSS score of 9.1, published 25 August 2026.
Which products and versions are affected?: Apache Tomcat 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0-M1-9.0.120, 10.1.0-M1-10.1.57, 11.0.0-M1-11.0.24; Apache Tomcat-Embed-Core 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0-M1-9.0.120, 10.1.0-M1-10.1.57, 11.0.0-M1-11.0.24; org.apache.tomcat:tomcat (Maven) ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.25; org.apache.tomcat:tomcat-catalina (Maven) ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.25; and 1 more.
Is there a fix for CVE-2026-68525?: Yes. org.apache.tomcat:tomcat (Maven): upgrade to 11.0.25 or later; org.apache.tomcat:tomcat-catalina (Maven): upgrade to 11.0.25 or later; org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 11.0.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-68525 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-68525?: Check whether you run Apache Tomcat, Apache Tomcat-Embed-Core, org.apache.tomcat:tomcat (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.tomcat:tomcat (Maven): upgrade to 11.0.25 or later

# set org.apache.tomcat:tomcat to 11.0.25 in your pom.xml or build.gradle

org.apache.tomcat:tomcat-catalina (Maven): upgrade to 11.0.25 or later

# set org.apache.tomcat:tomcat-catalina to 11.0.25 in your pom.xml or build.gradle

org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 11.0.25 or later

# set org.apache.tomcat.embed:tomcat-embed-core to 11.0.25 in your pom.xml or build.gradle

Technical details

This vulnerability is classified as CWE-863 (Incorrect Authorization) in Apache Tomcat's FORM authentication handler. The vulnerability occurs in the authentication process where security constraints that limit access to a resource for POST requests but not GET are incorrectly evaluated. An unauthenticated network attacker can exploit this with no special privileges or user interaction required, by sending GET requests to protected POST-only resources. The flaw allows attackers to read protected data (confidentiality impact) and potentially modify resources (integrity impact). Patches are available in versions 11.0.25, 10.1.58, 9.0.121, and later; versions 7.x and 8.5.x reached end-of-life before fixes were released.

Affected products

Apache Tomcat 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0-M1-9.0.120, 10.1.0-M1-10.1.57, 11.0.0-M1-11.0.24
Apache tomcat-catalina 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0-M1-9.0.120, 10.1.0-M1-10.1.57, 11.0.0-M1-11.0.24
Apache tomcat-embed-core 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0-M1-9.0.120, 10.1.0-M1-10.1.57, 11.0.0-M1-11.0.24

Identifiers

CVE-2026-68525
GHSA-h3x4-894j-xpx5

Timeline

2026-08-26: disclosed: Vulnerability disclosed via GitHub Advisory Database
2026-08-26: patched: Patches released for versions 11.0.25, 10.1.58, and 9.0.121

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.