CVE-2012-3546: org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FOR...

Security readout for executives and security teams

This issue affects Apache Tomcat deployments using FORM authentication. A remote attacker could bypass configured security constraints under specific request-handling conditions, potentially reaching protected application areas without the intended authorization checks. The source bundle identifies fixed Tomcat versions, but does not provide CVSS scoring or evidence of active exploitation. Exposure is most likely where legacy Apache Tomcat 6 or 7 instances use FORM authentication and security-constraint rules to protect application routes. Systems already upgraded to Tomcat 6.0.36, 7.0.30, or vendor-patched packages are less likely exposed. Treat this as high priority for legacy Tomcat environments because it can undermine access controls. The business urgency depends on whether affected Tomcat versions remain deployed and whether FORM authentication protects sensitive workflows. Mitigation focus: Upgrade Tomcat 6.x to 6.0.36 or later, if still in use.; Upgrade Tomcat 7.x to 7.0.30 or later, if still in use.; Apply vendor-patched packages from your operating system or appliance supplier..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.