Apache Tomcat auth bypass and Apache CXF JMS RCE flaw disclosed
Patch & Detection Intelligence · 5 sources · Updated 2mo ago · First seen May 12, 2026
Apache disclosed CVE-2026-43512, a moderate-severity authentication bypass in Tomcat's DIGEST authenticator that can let any user unknown to the configured Realm authenticate if the supplied password is "null". The flaw affects multiple supported branches, including Tomcat 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, and 9.0.0.M1 through 9.0.117, with older unsupported releases potentially affected. Apache advised users to upgrade to 11.0.22+, 10.1.55+, or 9.0.118+.
Apache also disclosed CVE-2026-44417, a moderate-severity flaw in the JMS transport component of Apache CXF caused by an incomplete fix for CVE-2025-48913. The remaining vulnerable code path can still lead to remote code execution when untrusted users are allowed to configure JMS. Affected releases include CXF JMS transport 4.2.0 before 4.2.1, 4.0.0 before 4.1.6, and all 3.6.x versions before 3.6.11; Apache said organizations should upgrade to 4.2.1, 4.1.6, or 3.6.11.
