VulnTideExploited vulnerabilities, by vendor. Data as of .
Known exploitedIn CISA's KEV catalog since Ransomware use: unknown
Apache Tomcat

CVE-2020-1938: Apache Tomcat Improper Privilege Management Vulnerability

Also known as Ghostcat

Is it exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on , 738 days after the CVE record was published.

How likely is exploitation in the next 30 days?
99.3%

EPSS score, percentile 99.9 of all scored records

How severe?
9.8 Critical

CVSS v3.1 base score, from CISA's enrichment of the record

What should I do?

CISA deadline . Apply updates per vendor instructions.

Advisories and patches (8)

Which versions are affected?

Affected

  • Apache Tomcat 9.0.0.M1 to 9.0.0.30
  • 8.5.0 to 8.5.50
  • 7.0.0 to 7.0.99

Versions by product

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.

What to do

Required action, set by CISA

Apply updates per vendor instructions.

CISA due date for this action: .

Advisories and patches

Linked from CISA's catalog entry

Affected products and versions

As listed in the CVE record.

Apache Apache Tomcat
StatusVersions
AffectedApache Tomcat 9.0.0.M1 to 9.0.0.30
Affected8.5.0 to 8.5.50
Affected7.0.0 to 7.0.99

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.

About this vulnerability

Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.

Summary: CISA's KEV catalog, as of .

  • CISA added CVE-2020-1938 to its Known Exploited Vulnerabilities (KEV) catalog on 3 Mar 2022.
  • It is widely known as Ghostcat, a common name that is not used in the CVE record or in CISA's catalog.
  • CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
  • The due date CISA sets for the required action is 17 Mar 2022.
  • The CVE record was published on 24 Feb 2020, 738 days before it was added to KEV.
  • The CVE record carries a CVSS v3.1 base score of 9.8 (Critical), taken from CISA's enrichment of the record.
  • FIRST's EPSS model puts the probability of exploitation in the next 30 days at 99.3% (percentile 99.9), as of 28 Oct 2026.
  • CISA's SSVC assessment in the CVE record: exploitation active, automatable yes, technical impact total.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of . About the data.

Description

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.

Timeline

DateEvent
CVE record published
Added to CISA KEV
CISA due date for the required action
CVE record last updated

References

39 more in the CVE record.

More exploited Apache vulnerabilities

  • CVE-2016-3081: Apache Struts Command Injection Vulnerability (added )
  • CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability (added )
  • CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability (added )
  • CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability (added )
  • CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability (added )
  • CVE-2024-45195: Apache OFBiz Forced Browsing Vulnerability (added )