CVE-2026-50229 Details.
Apache Tomcat - Cross-Site Scripting
Atlas does not check this one. Works by exploiting the flaw.
The only reliable test for this one is to try the weakness itself, which can disturb the site. Atlas does not do that, so it does not run this check.
About CVE-2026-50229. What It Means.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix th…
Affected Product. What Is Hit.
- Vendor
- apache
- Product
- Apache Tomcat
More CVEs In Apache Tomcat.
- CVE-2026-34486CriticalKnown exploitedInformation onlyApache Tomcat Tribes EncryptInterceptor Bypass - Remote Code ExecutionApacheCVSS9.8
- CVE-2019-0232HighApache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code ExecutionApacheCVSS8.1
- CVE-2000-0760MediumJakarta Tomcat 3.1 and 3.0 - Information DisclosureApacheCVSS6.4
- CVE-2023-45648MediumApache Tomcat - HTTP Request SmugglingApacheCVSS5.3
FAQ
Common Questions.
Apache Tomcat - Cross-Site Scripting. Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix th…
No. The only reliable test for this one is to try the weakness itself, which can disturb the site. Atlas does not do that, so it does not run this check. The facts about CVE-2026-50229 are on this page, and you can request a demo to see how Brandefense watches your whole external attack surface.
CVE-2026-50229 is not on the CISA Known Exploited Vulnerabilities list at the time of writing, but it is still worth fixing.
Update Apache Tomcat to the latest version from the vendor, or follow the vendor's advice to switch off the affected feature. Vendor links are listed on this page when they are known.
This page lists the public facts about CVE-2026-50229. Atlas does not run a check for it, so nothing here says whether a particular site is affected.