Apache Tomcat vulnerabilities: known CVEs & security history
Apache · Web / Runtime · 94 tracked CVEs · 6 actively exploited · updated October 2026 · what is a CVE? →
This is the full list of known vulnerabilities (CVEs) across all Apache Tomcat release lines — 94 in total, with 6 actively exploited in the wild. A CVE here doesn't mean your version is affected — check Apache Tomcat's current status and the safe version to run.
Known Apache Tomcat CVEs
Actively-exploited and most-severe first. Showing the top 80 of 94. Open any CVE for full details.
| CVE | Severity | CVSS | EPSS | Year |
|---|---|---|---|---|
| CVE-2020-1938⚡ exploited | critical | 9.8 | 99% | 2020 |
| CVE-2016-8735⚡ exploited | critical | 9.8 | 90% | 2017 |
| CVE-2017-12617⚡ exploited | high | 8.1 | 100% | 2017 |
| CVE-2017-12615⚡ exploited | high | 8.1 | 100% | 2017 |
| CVE-2026-34486⚡ exploited | high | 7.5 | 99% | 2026 |
| CVE-2023-44487⚡ exploited | high | 7.5 | 100% | 2023 |
| CVE-2026-65905 | critical | 9.8 | 1% | 2026 |
| CVE-2026-65637 | critical | 9.8 | 1% | 2026 |
| CVE-2018-8014 | critical | 9.8 | 21% | 2018 |
| CVE-2025-55754 | critical | 9.6 | 10% | 2025 |
| CVE-2026-68525 | critical | 9.1 | 1% | 2026 |
| CVE-2026-65182 | critical | 9.1 | 0% | 2026 |
| CVE-2026-59084 | critical | 9.1 | 0% | 2026 |
| CVE-2026-59083 | critical | 9.1 | 0% | 2026 |
| CVE-2026-55276 | critical | 9.1 | 0% | 2026 |
| CVE-2026-53434 | critical | 9.1 | 0% | 2026 |
| CVE-2016-5018 | critical | 9.1 | 10% | 2017 |
| CVE-2017-5648 | critical | 9.1 | 13% | 2017 |
| CVE-2016-0714 | high | 8.8 | 13% | 2016 |
| CVE-2015-5351 | high | 8.8 | 10% | 2016 |
| CVE-2022-25762 | high | 8.6 | 8% | 2022 |
| CVE-2026-68569 | high | 8.1 | 1% | 2026 |
| CVE-2026-66422 | high | 8.1 | 0% | 2026 |
| CVE-2026-65183 | high | 8.1 | 0% | 2026 |
| CVE-2016-5388 | high | 8.1 | 51% | 2016 |
| CVE-2015-5346 | high | 8.1 | 11% | 2016 |
| CVE-2014-0230 | high | 7.8 | 20% | 2015 |
| CVE-2020-8022 | high | 7.7 | 1% | 2020 |
| CVE-2026-68763 | high | 7.5 | 1% | 2026 |
| CVE-2026-65927 | high | 7.5 | 1% | 2026 |
| CVE-2026-29146 | high | 7.5 | 6% | 2026 |
| CVE-2026-24734 | high | 7.5 | 0% | 2026 |
| CVE-2025-55752 | high | 7.5 | 64% | 2025 |
| CVE-2022-29885 | high | 7.5 | 73% | 2022 |
| CVE-2021-41079 | high | 7.5 | 7% | 2021 |
| CVE-2021-25122 | high | 7.5 | 18% | 2021 |
| CVE-2020-17527 | high | 7.5 | 25% | 2020 |
| CVE-2020-13935 | high | 7.5 | 87% | 2020 |
| CVE-2020-13934 | high | 7.5 | 64% | 2020 |
| CVE-2020-11996 | high | 7.5 | 27% | 2020 |
| CVE-2019-17563 | high | 7.5 | 11% | 2019 |
| CVE-2017-12616 | high | 7.5 | 70% | 2017 |
| CVE-2016-6796 | high | 7.5 | 8% | 2017 |
| CVE-2016-6797 | high | 7.5 | 8% | 2017 |
| CVE-2017-5664 | high | 7.5 | 17% | 2017 |
| CVE-2016-3092 | high | 7.5 | 36% | 2016 |
| CVE-2014-0050 | high | 7.5 | 83% | 2014 |
| CVE-2026-55957 | high | 7.3 | 0% | 2026 |
| CVE-2026-53404 | high | 7.3 | 0% | 2026 |
| CVE-2021-25329 | high | 7 | 9% | 2021 |
| CVE-2020-9484 | high | 7 | 56% | 2020 |
| CVE-2019-12418 | high | 7 | 1% | 2019 |
| CVE-2026-73180 | medium | 6.8 | 0% | 2026 |
| CVE-2013-4444 | medium | 6.8 | 14% | 2014 |
| CVE-2013-2067 | medium | 6.8 | 7% | 2013 |
| CVE-2026-55956 | medium | 6.5 | 0% | 2026 |
| CVE-2026-55955 | medium | 6.5 | 0% | 2026 |
| CVE-2021-30640 | medium | 6.5 | 10% | 2021 |
| CVE-2018-1305 | medium | 6.5 | 14% | 2018 |
| CVE-2014-0227 | medium | 6.4 | 21% | 2015 |
| CVE-2016-0763 | medium | 6.3 | 11% | 2016 |
| CVE-2026-50229 | medium | 6.1 | 0% | 2026 |
| CVE-2022-34305 | medium | 6.1 | 7% | 2022 |
| CVE-2023-42794 | medium | 5.9 | 2% | 2023 |
| CVE-2021-24122 | medium | 5.9 | 23% | 2021 |
| CVE-2018-1304 | medium | 5.9 | 17% | 2018 |
| CVE-2016-0762 | medium | 5.9 | 8% | 2017 |
| CVE-2013-4286 | medium | 5.8 | 17% | 2014 |
| CVE-2026-66299 | medium | 5.3 | 0% | 2026 |
| CVE-2025-61795 | medium | 5.3 | 1% | 2025 |
| CVE-2021-33037 | medium | 5.3 | 75% | 2021 |
| CVE-2016-6794 | medium | 5.3 | 7% | 2017 |
| CVE-2015-5345 | medium | 5.3 | 18% | 2016 |
| CVE-2014-7810 | medium | 5 | 14% | 2015 |
| CVE-2014-0075 | medium | 5 | 20% | 2014 |
| CVE-2012-3544 | medium | 5 | 11% | 2013 |
| CVE-2012-5568 | medium | 5 | 10% | 2012 |
| CVE-2012-5887 | medium | 5 | 12% | 2012 |
| CVE-2012-5886 | medium | 5 | 9% | 2012 |
| CVE-2012-5885 | medium | 5 | 9% | 2012 |
14 older / lower-severity CVEs not shown — see Apache Tomcat's full record.
Is my Apache Tomcat version affected?
The list above spans every release. To know whether your version is affected — and the minimum safe version to upgrade to — check it directly.
Check your Apache Tomcat version → · Monitor Apache Tomcat for new CVEs →
Apache Tomcat vulnerabilities — frequently asked
How many known vulnerabilities does Apache Tomcat have?
IsItPatched tracks 94 CVEs for Apache Tomcat, 6 of which are actively exploited (CISA KEV). 14 are critical-severity and 38 high-severity. These span every release line — what matters is whether the version you run is affected.
Does Apache Tomcat have any actively-exploited vulnerabilities?
Yes — 6 Apache Tomcat CVEs are in CISA's Known Exploited Vulnerabilities catalog, meaning they are confirmed exploited in the wild (1 linked to ransomware). Patch these as a priority.
What is the most severe Apache Tomcat vulnerability?
Among tracked issues, CVE-2020-1938 (CRITICAL, CVSS 9.8), which is actively exploited, ranks highest.
Is Apache Tomcat safe to use?
It depends on the version. The latest supported Apache Tomcat release (11.0.27) clears the known issues; older versions may still be affected. Check the exact version you run for a verdict.
CVE data aggregated from NVD, CISA KEV and EPSS (FIRST.org). Related: Apache Tomcat security status · Apache Tomcat end-of-life · actively-exploited CVEs. Always verify against Apache's advisories — see our disclaimer.