Dashboard / CVE-2026-55957

CVE-2026-55957

HIGH
MEDIUM Priority: 0.21 BB Relevance: 75/100
Published: 2026-06-29 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: Low
I: Low
A: Low

Description

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
apache tomcat < 9.0.101
apache tomcat 10.1.0 – 10.1.37
apache tomcat 11.0.0 – 11.0.5

References & Advisories (2)

Bug Bounty Relevance

75 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

7.3 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS — Exploitation Probability

2.85%
Raw Score 0.028550
Percentile 86.7%
Date 2026-10-29

EPSS Trend

2026-10-29
0.02855
2026-10-28
0.02855

Intelligence Sources

nvd ref →

External Links