CVE-2026-65182

Apache Tomcat: Bypass longest prefix security constraint

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.

We have discovered 5,696 live websites that are affected by CVE-2026-65182.

Run a Free Instant Scan



Affected Software

Product  Apache Tomcat
Category Web Servers
Vulnerable Domains5,696 live websites (80% of Apache Tomcat install base)
Vulnerable Versions
  • from 7 through 7.0.109
  • from 8.5 through 8.5.100
  • from 9 through 9.0.120
  • from 10.1 through 10.1.57
  • from 11 through 11.0.24
Vulnerable Versions Count298 versions ( 79% of all versions)


Common Weakness Enumeration

CWE-284 Improper Access Control



Details

  • Published - Aug 25, 2026
  • Updated - Aug 26, 2026

Credits

  • 4ra1n, pyn3rd and unam4 (finder)

Website Distribution by Country

Number of websites using CVE-2026-65182
United States1,855 websites


China1,180 websites
Germany348 websites
France169 websites
Italy167 websites
Brazil115 websites
India110 websites
GB108 websites
Hong Kong107 websites

Website Distribution by TLD

Number of websites using CVE-2026-65182
.com2,430 websites
.cn268 websites
.de230 websites
.net220 websites
.edu200 websites
.org184 websites
.it155 websites
.com.br136 websites
.com.cn98 websites
.fr77 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-65182

Top websites that are affected by CVE-2026-65182. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***.***.edu United States***
**************.com United States**,***
**.***.*****.*****.***.com United States**,***
*****.********.com United States**,***
*********.**********.com United States**,***
**.******.com United States**,***
************.com United States**,***
***.*******.com United States**,***
***.*********.edu United States**,***
******.com China**,***
See full domain list

FAQ

CVE-2026-65182 is Improper Access Control in Apache Tomcat
A total of 5,696 websites have been identified as vulnerable to CVE-2026-65182, based on global website indexing conducted by WebTechSurvey.
The Apache Tomcat is affected by the CVE-2026-65182 vulnerability.
Apache Tomcat versions up to and including 11.0.24 are vulnerable to CVE-2026-65182.