Loading story…
Oracle's July 2018 Critical Patch Update includes remediation for CVE-2014-7810, a vulnerability in Apache Tomcat's Expression Language (EL) implementation. The flaw affects Tomcat 6 releases before 6.0.44, Tomcat 7 releases before 7.0.58, and Tomcat 8 releases before 8.0.16.
A remote attacker able to deploy or control a web application could exploit EL evaluation performed with incorrect privileges when an accessible interface is implemented by an inaccessible class. Successful exploitation can bypass Java SecurityManager protections, undermining application sandboxing; organizations should ensure affected Tomcat deployments are updated to the fixed versions or later.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2014-7810 was updated.
The CVE record for CVE-2014-7810 was published, documenting an Apache Tomcat Expression Language vulnerability affecting Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16.
Red Hat opened Bug 1222573 for the EL-based Security Manager bypass affecting Tomcat and JBoss Web, classifying it as medium severity. Red Hat later issued advisories for JBoss Web Server 2.1 and Tomcat packages on RHEL 6 and 7.
Apache Tomcat released versions 6.0.44, 7.0.58, and 8.0.16, which fix an Expression Language flaw that could let a web application bypass Java SecurityManager protections.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcerhn.redhat.com
Open sourcebugzilla.redhat.com
Open sourceoracle.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache Tomcat has remediated **CVE-2026-65182**, a critical improper authorization and access-control flaw (**CVSS 9.1**) that can let an unauthenticated remote attacker bypass configured security constraints. The issue arises when a constraint for a longer URL path is declared before a more restrictive constraint for a shorter subpath, causing Tomcat to apply access controls incorrectly. No public exploitation was known at the time of the notices. Affected releases include Tomcat 7.0.0–7.0.109, 8.5.0–8.5.100, 9.0.0.M1–9.0.120, 10.1.0-M1–10.1.57, and 11.0.0-M1–11.0.24, including deployments using embedded Tomcat libraries. Organizations should identify exposed instances and update to fixed releases—Tomcat 9.0.121, 10.1.58 or later, and 11.0.25 or later—while validating URL security-constraint ordering after remediation.
Sep 3, 2026
Apache released Tomcat **11.0.25**, **10.1.58**, and **9.0.121** to remediate 11 vulnerabilities across supported release lines. The most consequential issues include `CVE-2026-68569`, where DataSourceRealm principal lookup can fail open with mechanisms such as CLIENT-CERT or SPNEGO; `CVE-2026-65182`, which can bypass security constraints based on path-rule ordering; and `CVE-2026-65927`, an off-by-one RewriteValve error that may bypass access controls. `CVE-2026-68763` also permits denial of service through an HTTP/2 backlog-tracking allocation leak when streams are reset. The updates additionally address authorization bypasses involving FORM-authentication redirects (`CVE-2026-68525`) and `security-role-ref` aliases (`CVE-2026-66422`), a limited DIGEST-authentication replay condition (`CVE-2026-65905`), an HTTP/2 strict-SNI-validation bypass from an incomplete prior fix (`CVE-2026-65637`), a Unix-domain-socket permission race (`CVE-2026-65183`), and WebSocket sessions that can survive expiration of their associated HTTP session (`CVE-2026-73180`). Organizations should prioritize upgrades, particularly for internet-facing deployments; Tomcat 7 and 8.5 installations are end of life and should be retired or otherwise remediated. No confirmed in-the-wild exploitation or public proof-of-concept code was reported.
Aug 31, 2026
Apache Tomcat released security updates addressing several vulnerabilities across supported branches, including **CVE-2026-59083**, an incorrect URL decoding flaw in `RewriteValve` that can let attackers bypass security constraints in some configurations, and **CVE-2026-59084**, a documentation-related weakness that left `EncryptInterceptor` deployments without clearly defined secure configuration requirements. Apache said affected versions span Tomcat 11, 10.1, 9.0, and 8.5 releases, with some unsupported end-of-life versions potentially exposed as well. Separate Tomcat advisories also described additional patched issues, including **CVE-2026-53434**, an invalid CRL configuration vulnerability rated **CVSS 9.1**, **CVE-2026-50229**, a cross-site scripting flaw in the Number Guess example, and other fixes tracked as **CVE-2026-53404**, **CVE-2026-55276**, **CVE-2026-55955**, and **CVE-2026-55956**. Organizations were urged to test and deploy updated releases, with Apache recommending upgrades to **11.0.24**, **10.1.57**, and **9.0.120** to remediate the newly disclosed issues.
Aug 28, 2026