Skip to content

CVE-2026-65927: Access Control Bypass via RewriteValve Off-By-One Error in Apache Tomcat

HERMES

HERMES THREAT SCORE & OPERATIONAL EXPOSURE

Target: RewriteValve (Apache Tomcat) — Apache Tomcat
Confidence: 90%
85 / 100
HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 16 / 20
Threat Activity 17 / 20
Weaponization 15 / 20
Exposure 18 / 20
Prevalence 19 / 20
Impact 16 / 20
Exploit Maturity 16 / 20
Attack Chain Potential 16 / 20
⚖️ Divergence & Operational Rationale

Hermes rates CVE-2026-65927 at 85 (HIGH). When administrators utilize the `[N]` (Next) flag in `rewrite.config` to iterate through rewrite sequences, an off-by-one index loop bug causes the engine to restart matching at rule 2 instead of rule 1. Crucial initial rules enforcing authentication checks or blocking blacklisted paths are skipped entirely.

HASS

HASS INFRASTRUCTURE & AGENTIC IMPACT POSTURE

Target: Tomcat Reverse Proxies, URL Rewrite Filters & Access Control Valves
Confidence: 92%
79 / 100
HIGH

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown
Autonomy 14 / 20
Tool Access 14 / 20
Privilege 14 / 15
Persistence 14 / 15
External Impact 13 / 15
Propagation 13 / 15
⚖️ Divergence & Operational Rationale

Critical enterprise Java applications, microservice clusters, and CI/CD pipelines depend on strict memory and authorization boundaries. Vulnerabilities in core components like RewriteValve (Apache Tomcat) allow adversaries to break through sandbox isolation and compromise business-critical assets.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-65927: Access Control Bypass via RewriteValve Off-By-One Error in Apache TomcatVULNERABILITY

Connected Nodes: 1
Active Relationships (Outgoing)
→ affectsPRODUCTApache Tomcat
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Apache Tomcat documented in Hermes dossier.”

Supporting Verified Evidence:

1. Technical Context & Affected Software Matrix

Section titled “1. Technical Context & Affected Software Matrix”

The vulnerability CVE-2026-65927 resides in the RewriteValve (Apache Tomcat) subsystem of Apache Tomcat.

+-----------------------------------------------------------------------------------------+
| JAVA RUNTIME ECOSYSTEM |
| |
| +---------------------------------------------------------------------------------+ |
| | APPLICATION & MICROSERVICE LAYER | |
| | Spring Boot / Quarkus / Micronaut / Web Applications / Custom JVM Services | |
| +---------------------------------------+-----------------------------------------+ |
| | |
| v |
| +---------------------------------------------------------------------------------+ |
| | AFFECTED SUBSYSTEM: RewriteValve (Apache Tomcat) | |
| | Root Flaw: Off-by-one Error | |
| +---------------------------------------+-----------------------------------------+ |
| | |
| v |
| +---------------------------------------------------------------------------------+ |
| | OPERATING SYSTEM & CONTAINER ENGINE | |
| | Linux / Windows / Docker / Kubernetes Pod Sandboxes & Native Libraries | |
| +---------------------------------------------------------------------------------+ |
+-----------------------------------------------------------------------------------------+
DimensionSpecification
Vulnerability IdentifierCVE-2026-65927
Component AffectedRewriteValve (Apache Tomcat)
Primary CWECWE-193 (Off-by-one Error)
CVSS v3.1 Score & Vector7.5 (HIGH) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector / SurfaceAV:N (Unauthenticated, Scope Unchanged (S:U))
Integrity ImpactNone
Confidentiality ImpactHigh (Total Memory / Data Disclosure)
Availability ImpactNone
Affected ReleasesTomcat 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, 9.0.0.M1 through 9.0.120, 8.5.0 through 8.5.100 (EOL)
Recommended Safe Version11.0.25, 10.1.59, 9.0.121

The defect in CVE-2026-65927 is caused by off-by-one error within RewriteValve (Apache Tomcat).

When untrusted data or requests reach this component, the missing boundary validation or logic error triggers an unexpected state transition, as depicted in the sequence diagram below:

sequenceDiagram
autonumber
actor Attacker as Threat Actor / Malicious Client
participant Service as Java Host / Gateway
participant Component as Subsystem (RewriteValve (Apache Tomcat))
participant Target as JVM Memory / Host OS
Attacker->>Service: Dispatch crafted payload (Off-By-One Logic Error / Rule Evaluation Bypass)
Service->>Component: Forward input to processing pipeline
activate Component
Note over Component: CWE-193: Validation failure / logic defect
Component->>Target: Trigger uncontrolled condition (Confined to JVM Process & Container Sandbox)
deactivate Component
Target-->>Attacker: Exploit effect achieved (Off-By-One Logic Error / Rule Evaluation Bypass)

Deploy the following detection rules to monitor runtime behavior and identify exploitation attempts against CVE-2026-65927.

title: Suspicious Activity Related to CVE-2026-65927 (RewriteValve (Apache Tomcat))
id: cve-2026-65927-sigma-detection
status: experimental
description: Detects unusual execution patterns or anomalous errors matching CVE-2026-65927 exploitation.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-65927
- https://hermes-codex.dev/cve/2026/cve-2026-65927/
author: Hermes Codex Cyber Threat Intelligence
date: 2026-09-15
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- '/catalina.sh'
selection_child:
Image|endswith:
- '/java'
condition: selection_parent and selection_child
fields:
- CommandLine
- Image
- ParentCommandLine
falsepositives:
- Legitimate administrative maintenance
- Authorized automated deployments
level: high
tags:
- attack.execution
- attack.initial_access
- cve.cve-2026-65927

Network Detection Signature (Suricata / Snort)

Section titled “Network Detection Signature (Suricata / Snort)”
alert tcp any any -> $HOME_NET any (msg:"HERMES-CODEX - Potential CVE-2026-65927 Exploitation Pattern in RewriteValve (Apache Tomcat)"; flow:to_server,established; content:"|00|"; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-admin; sid:2026659271; rev:1; metadata:cve CVE-2026-65927, hermes_threat_score 85;)
rule Hermes_CVE_2026_65927_Artifact {
meta:
description = "Identifies in-memory patterns and exploit strings associated with CVE-2026-65927"
author = "Hermes Codex Research"
cve = "CVE-2026-65927"
severity = "HIGH"
date = "2026-09-15"
strings:
$fp1 = "RewriteValve (Apache Tomcat)" ascii wide
$fp2 = "CWE-193" ascii wide
$magic = "CVE-2026-65927" ascii wide
condition:
all of them
}

4. Remediation, Patching & Defensive Hardening

Section titled “4. Remediation, Patching & Defensive Hardening”
  1. Apply Official Vendor Security Patches: Upgrade your installation of Apache Tomcat to 11.0.25, 10.1.59, 9.0.121 or newer immediately.

  2. Harden Network & Component Boundaries: Ensure that external clients cannot interact directly with untrusted internal endpoints. Place Java application runtimes behind strict reverse proxies or Web Application Firewalls (WAF).

  3. Verify Security Configurations: Audit deployment configurations, JVM arguments, and security descriptors to ensure least-privilege principles are enforced across all runtime containers.


Section titled “5. Related Intelligence & Cross-References”