The version of Tomcat installed on the remote host is prior to 9.0.122. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.122_security-9 advisory.

  - CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled     vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from     10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26,     10.1.60 or 9.0.122, which fix the issue. (CVE-2026-86248)

  - Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an     unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1     through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be     affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be     affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78383)

  - Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM     TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from     11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121. The following     versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through     8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version     11.0.26, 10.1.59, 9.0.122, which fixes the issue. (CVE-2026-73581)

  - Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with     SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the     realm for the first web application to authenticate a request would be used for all web applications. This     issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4     through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be     affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are     recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue. (CVE-2026-75973)

  - Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints     for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through     11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at     the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through     7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version     11.0.26, 10.1.60 or 9.0.122, which fix the issue. (CVE-2026-76183)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Apache Tomcat 9.0.0.M1 < 9.0.122 multiple vulnerabilities

critical Nessus Plugin ID 349472

Version 1.3

Version 1.2

Version 1.3 Oct 26, 2026, 2:57 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True") Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202610261457
Version 1.2 Sep 25, 2026, 6:49 PM Plugin metadata (Add IAVM Info) Plugin Feed: 202609251849