CVE-2026-59083 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-59083 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-59083 is a security constraint bypass vulnerability in Apache Tomcat's rewrite valve, caused by improper handling of hex-encoded URL sequences.

Technical Detail

The flaw exists in Tomcat's rewrite valve, which processes URL rewriting rules before security constraints are evaluated. An attacker can craft a request using percent-encoded (hex-encoded) characters in the URL path that the rewrite valve fails to normalize correctly, allowing the request to bypass configured security constraints and access protected resources without proper authorization. The practical impact depends on the specific deployment configuration, but in affected setups this constitutes an authentication or access control bypass, potentially exposing restricted endpoints or administrative interfaces to unauthenticated or unauthorized users.

Exploitation Status

No known exploit code exists for this vulnerability at this time. It is not listed in the CISA Known Exploited Vulnerabilities catalog, and there is no confirmed public proof-of-concept. The vulnerability is newly disclosed and exploitation in the wild has not been reported.

Who Is Targeting This

No specific threat actor attribution at this time. No confirmed or reported threat actors have been linked to exploitation of this vulnerability.

What To Do

Organizations running Apache Tomcat 11.0 or later with the rewrite valve enabled should treat this as a priority patch given the critical CVSS score of 9.1 and the nature of the bypass. Apply the latest patched release of Apache Tomcat as soon as it becomes available from the Apache Software Foundation. As an interim measure, administrators should audit rewrite valve configurations and consider disabling the rewrite valve if it is not operationally required, or restricting access to sensitive paths through additional network-layer controls such as a web application firewall or reverse proxy with strict URL normalization. Monitor access logs for anomalous requests containing percent-encoded path segments targeting protected resources.