Vulnerability Scan reports Apache Tomcat CVE-2026-41284 and others in Applications Manager
search cancel

Vulnerability Scan reports Apache Tomcat CVE-2026-41284 and others in Applications Manager

book

Article ID: 448702

calendar_today

Updated On:

Products

Automic Applications Manager

Issue/Introduction

Vulnerability scans may flag CA Automic Applications Manager (AM) for several Apache Tomcat-related vulnerabilities, including:

  • CVE-2026-41284
  • CVE-2026-41293
  • CVE-2026-42498
  • CVE-2026-43512
  • CVE-2026-43513
  • CVE-2026-43514
  • CVE-2026-43515.

Environment

  • CA Automic Applications Manager (AM) version 9.6 to 9.6.1

Cause

Applications Manager ships the tomcat-embed-el library, which is the Apache implementation for Javax EL (Expression Language). It does not use Apache Tomcat as a web server or the full Tomcat library suite to implement a web server engine. Security scanners often flag the presence of these libraries regardless of whether the specific vulnerable code paths are active.

Resolution

Applications Manager is not exploitable for the following CVEs because the required Tomcat components (WebDAV servlet, HTTP/2 HPACK parsing, Tribes clustering, etc.) are not utilized by the application architecture:

  1. CVE-2026-41284 (WebDAV DoS): Not applicable. AM does not run the core Tomcat web server engine or the WebDAV servlet.
  2. CVE-2026-41293 (HTTP/2 Header Validation): Not applicable. AM implements its own network listener architecture and does not use Tomcat's HTTP/2 mechanisms.
  3. CVE-2026-42498 (WebSocket Credential Leak): Not applicable. AM does not rely on Tomcat’s native WebSocket client wrapper.
  4. CVE-2026-43512 (Digest Auth Bypass): Not applicable. AM uses a proprietary security engine and does not utilize Tomcat's DigestAuthenticator.
  5. CVE-2026-43513 (LockOutRealm Bypass): Not applicable. AM does not use Tomcat's LockOutRealm for login throttling.
  6. CVE-2026-43514 (AJP Timing Attack): Not applicable. AM does not deploy Tomcat AJP connectors.
  7. CVE-2026-43515 (Security Constraint Bypass): Not applicable. AM does not process requests using Tomcat's deployment engine or web.xml security constraints.

Remediation: Broadcom recommends upgrading to Applications Manager 9.6.2 or higher, which migrates the embedded web server from Apache Tomcat to Jetty.

Additional Information

Users may subscribe to this article (Reference: ) to be updated on fix status.

Powered by Wolken Software