Red Hat Product Security issued an advisory (RHSA-2026:18537) for Apache Tomcat vulnerabilities affecting Red Hat Enterprise Linux 10. The update fixes three security issues: CVE-2025-46701 (security constraint bypass for CGI scripts), CVE-2025-55668 (session fixation via rewrite valve), and CVE-2025-55754 (console manipulation). These vulnerabilities impact the Tomcat servlet container and related components. The advisory includes updated Tomcat packages for multiple architectures and variants of Red Hat Enterprise Linux 10. The vendor rates the update as Important and provides detailed release notes and update instructions. No CVSS scores are provided in the advisory, and no exploits are known in the wild.

Successful exploitation of these vulnerabilities could allow attackers to bypass security constraints on CGI scripts, perform session fixation attacks via the rewrite valve, or manipulate the console, potentially leading to unauthorized access or session hijacking. The exact impact depends on the deployment and configuration of Apache Tomcat. Red Hat classifies the security impact as Important (high severity). No known active exploitation has been reported.

Red Hat has released updated Tomcat packages for Red Hat Enterprise Linux 10 that address these vulnerabilities. Users should apply the official security update RHSA-2026:18537 promptly following Red Hat's published instructions. The vendor advisory confirms the availability of an official fix. No additional mitigation steps beyond applying the update are specified.