A critical authentication bypass vulnerability in Apache Tomcat allows unauthenticated remote attackers to potentially gain unauthorized access to protected resources.

The vulnerability stems from an authentication failure in the CLIENT_CERT mechanism when soft fail is disabled. This allows an unauthenticated attacker to bypass security checks and potentially interact with the application as an authorized user.

The potential for unauthenticated access to an application server carries severe business risks, including full system compromise, unauthorized data exfiltration, and the manipulation of sensitive backend processes. Given the critical CVSS score of 9.8, this flaw represents a high risk to availability, integrity, and confidentiality, making immediate remediation essential to prevent unauthorized lateral movement within the network.

Immediate Action: Upgrade to Apache Tomcat versions 11.0.26, 10.1.60, or 9.0.122, which contain the necessary security fixes for this flaw.

Proactive Monitoring: Review web server access logs for anomalous request patterns or unexpected successful authentication events originating from unknown sources.

Compensating Controls: Implement strict network-level access control lists or a Web Application Firewall to block unauthorized traffic and monitor for attempts to exploit authentication endpoints.

Public Exploit Available: Unknown

Organizations running the affected versions of Apache Tomcat should prioritize patching as a matter of urgency. The ability for an unauthenticated actor to bypass authentication mechanisms exposes the entire application environment to significant risk, and administrators should verify that their specific environment is updated to the provided fixed versions to ensure complete mitigation.