Apache Tomcat Vulnerabilities Enables Bypass of EncryptInterceptor

Cybersecuritynews •Abinaya • April 13, 2026

The Apache Software Foundation has released emergency security updates to address multiple vulnerabilities in Apache Tomcat. The latest advisories highlight a critical patching error that inadvertently exposed servers to an interception bypass, as well as issues affecting certificate authentication and padding-oracle attacks. Administrators must update their deployments immediately to secure their environments against potential exploitation. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Apache Tomcat Vulnerabilities Risk Encrypted Communications The Apache Software Foundation has issued emergency security updates for Apache Tomcat to address multiple critical vulnerabilities that could allow attackers to bypass the EncryptInterceptor. These vulnerabilities include issues with certificate authentication and padding-oracle attacks, which could lead to the compromise of encrypted communications. Organizations using Apache Tomcat, a widely deployed open-source web server, are at significant risk if they do not apply the updates immediately. The flaws could enable attackers to exploit flawed patches and intercept sensitive data. Administrators are urged to secure their environments against potential exploitation. Specific CVEs have not been disclosed in the articles, but the urgency of the situation is clear. The vulnerabilities affect numerous enterprise environments globally, highlighting the need for prompt action. Failure to update could result in severe security breaches. 2 sources 70

Extracted Entities

Platforms (1)

Apache Tomcat