CVE-2026-50229

MEDIUM 6.1 PoC AVAILABLE

Published 2026-06-29 · Last modified 2026-06-30

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

EXPLOIT AVAILABLE

Public exploit or PoC code exists. Modeled probability is still low, but the barrier to attack is reduced — watch closely.

Exploitation likelihood

2.6%chance of exploitation in 30 days · 83rd percentile

○ In CISA KEV ● Public exploit / PoC

Impact if exploited

6.1CVSS 3.1 · MEDIUM

ConfidentialityLow
IntegrityLow
AvailabilityNone

What an attacker needs

✓Access: Reachable over the network — no local access needed
✓Privileges: No account or privileges required
⚠User interaction: A user must take an action (click / open a file)
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

nuclei Nuclei detection template
github-search Search GitHub for public PoC repos

Test against your own equipment

nuclei -id CVE-2026-50229 -u https://TARGETDetection template — non-destructive check that a target is affected.

curl -s https://vulnpedia.com/cve/CVE-2026-50229/poc.jsonMachine-readable PoC index for this CVE (for automation).

Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-50229/poc.json

Affected

Vendors Apache Software Foundation Apache

Products Apache Tomcat Tomcat

Weakness (CWE)

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Known Affected Software Configurations

Vendor	Product	Version range
Apache	Tomcat	≤ 7.0.109
Apache	Tomcat	≥ 8.5.0 and ≤ 8.5.100
Apache	Tomcat	≥ 9.0.0 and < 9.0.119
Apache	Tomcat	≥ 10.1.0 and < 10.1.56
Apache	Tomcat	≥ 11.0.0 and < 11.0.23

All CVSS metrics

MEDIUM 6.1 v3.1 · ADP Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
MEDIUM 6.1 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Advisories

https://lists.apache.org/thread/wlt2no8bw45zl1w8byop4zfqphldf5j0 vendor-advisoryVendor AdvisoryMailing List
http://www.openwall.com/lists/oss-security/2026/06/29/20 Third Party Advisory

Sources: NVD · CVE.org · EPSS