Is CVE-2026-75973 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75973 being exploited in the wild.

How severe is CVE-2026-75973?

High severity, with a CVSS score of 7.3, published 23 September 2026.

Which products and versions are affected?

Apache Tomcat 8.5.0 through 8.5.100, 9.0.0.M4 through 9.0.121, 10.1.0-M1 through 10.1.59, 11.0.0-M1 through 11.0.25.

Is there a fix for CVE-2026-75973?

A patch was published on 2026-09-23: Fixed in versions 11.0.26, 10.1.60, 9.0.122 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-75973 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-75973?

Check whether you run Apache Tomcat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75973: Apache Tomcat improper authentication in Jakarta Authentication

CVE-2026-75973 · Severity: high · CVSS 7.3 · Published 2026-09-23

Apache Tomcat is an application server that runs web applications. When Jakarta Authentication is configured with SimpleAuthConfigProvider, the authentication realm of the first web application is incorrectly reused for all other web applications on the same server. An attacker could exploit this to access other users' accounts or data across different applications without proper authentication.

Technologies: Apache Tomcat. Vendors: Apache.

Quick answers

Is CVE-2026-75973 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75973 being exploited in the wild.
How severe is CVE-2026-75973?: High severity, with a CVSS score of 7.3, published 23 September 2026.
Which products and versions are affected?: Apache Tomcat 8.5.0 through 8.5.100, 9.0.0.M4 through 9.0.121, 10.1.0-M1 through 10.1.59, 11.0.0-M1 through 11.0.25.
Is there a fix for CVE-2026-75973?: A patch was published on 2026-09-23: Fixed in versions 11.0.26, 10.1.60, 9.0.122 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75973 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-75973?: Check whether you run Apache Tomcat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper authentication issue in Apache Tomcat's Jakarta Authentication implementation with SimpleAuthConfigProvider configured as the default provider. When multiple web applications use this provider, the authentication realm from the first application to process a request is reused for all subsequent authentication attempts across different applications, bypassing application-specific authentication contexts. This allows cross-context authentication bypass in multi-application deployments.

Affected products

Apache Tomcat 8.5.0 through 8.5.100, 9.0.0.M4 through 9.0.121, 10.1.0-M1 through 10.1.59, 11.0.0-M1 through 11.0.25

Timeline

2026-09-23: disclosed
2026-09-23: patched: Fixed in versions 11.0.26, 10.1.60, 9.0.122

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.