Linux · Security advisory · September 18, 2026

ELSA-2026-68651: Security update for 8 packages

ELSA-2026-68651, released September 18, 2026, fixes 8 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent

CVEs closed

1 rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0171

77th percentile

Priority of the 8 CVEs

Patch now 0
                                Urgent 1
                                High 7
                                Routine 0

Fixed package versions

Product	Release	Fixed in
tomcat9	ol 10	1:9.0.120-1.el10_2
tomcat9-admin-webapps	ol 10	1:9.0.120-1.el10_2
tomcat9-docs-webapp	ol 10	1:9.0.120-1.el10_2
tomcat9-el-3.0-api	ol 10	1:9.0.120-1.el10_2
tomcat9-jsp-2.3-api	ol 10	1:9.0.120-1.el10_2
tomcat9-lib	ol 10	1:9.0.120-1.el10_2
tomcat9-servlet-4.0-api	ol 10	1:9.0.120-1.el10_2
tomcat9-webapps	ol 10	1:9.0.120-1.el10_2

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Urgent	CVE-2026-59084	tomcat11: Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the...	9.1	0.0051	None reported
High	CVE-2026-41293	jws6-tomcat: Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11...	9.8	0.0171	None reported
High	CVE-2026-43512	jws6-tomcat: DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects...	9.8	0.0133	None reported
High	CVE-2026-43515	jws6-tomcat: Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in...	9.1	0.0122	None reported
High	CVE-2026-42498	jws6-tomcat: Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache To...	7.3	0.0069	None reported
High	CVE-2026-59083	jws7-tomcat: Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security cons...	9.1	0.0052	None reported
High	CVE-2026-43513	jws6-tomcat: Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomca...	7.5	0.0050	None reported
High	CVE-2026-32990	tomcat: Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affec...	7.3	0.0031	None reported

Also fixes CVE-2026-59084

RHSA-2026:68677
tomcat, tomcat-admin-webapps, tomcat-docs-webapp and 5 more on RHEL 8
ALSA-2026:68677
tomcat, tomcat-admin-webapps, tomcat-docs-webapp and 5 more on almalinux 8
RHSA-2026:67163
tomcat9 on RHEL 10
RHSA-2026:68660
tomcat, tomcat-admin-webapps, tomcat-docs-webapp and 5 more on RHEL 9
ALSA-2026:68651
tomcat9, tomcat9-admin-webapps, tomcat9-docs-webapp and 5 more on almalinux 10
ALSA-2026:68660
tomcat, tomcat-admin-webapps, tomcat-docs-webapp and 5 more on almalinux 9
ALAS2023-2026-1945
tomcat9, tomcat9-admin-webapps, tomcat9-docs-webapp and 5 more on amzn 2023
ALAS2023-2026-1946
tomcat10, tomcat10-admin-webapps, tomcat10-docs-webapp and 5 more on amzn 2023

Vendor advisory

https://linux.oracle.com/errata/ELSA-2026-68651.html

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo