ReviewHigh

CVE-2026-65927

Apache Software Foundation Apache Tomcat, tomcat

Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.

CVSS: 7.5
EPSS: -
CISA KEV: Not listed
Published: 2026.08.26

PRIORITY ASSESSMENT

Review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability-

Technical severityCVSS 7.5

Vulnerability overview

Affected product and versions

Product: Apache Software Foundation Apache Tomcat, tomcat
Affected versions: >= 11.0.0-M1 <= 11.0.24, >= 10.1.0-M1 <= 10.1.57, >= 9.0.0.M1 <= 9.0.120, >= 8.5.0 <= 8.5.100, >= 8.5.0 < 9.0.121, >= 10.1.0 < 10.1.58, >= 11.0.0 < 11.0.25
Fixed versions: 9.0.121, 10.1.58, 11.0.25

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Apache Software Foundation Apache Tomcat, tomcat and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-193