WinMagic
Security Advisory
CVE-2026-73581 — Apache Tomcat Improper Certificate Revocation Check Vulnerability
Reference: KB-SEC-2026-1028-01 | Published: October 28, 2026 | Status: Not Affected
Applies to: SecureDoc Client, SES Console, SESWeb (all versions)
Third-party component affected: Apache Tomcat | Severity: Medium
Executive summary
WinMagic is aware of CVE-2026-73581 (Apache Tomcat Improper Certificate Revocation Check Vulnerability), a vulnerability affecting Apache Tomcat. WinMagic has reviewed this CVE against SecureDoc Client, the SES Console and SESWeb. None of these products is affected, for the reason given below. No remediation, patch, or configuration change is required in response to this CVE.
Vulnerability details
CVE ID | CVE-2026-73581 |
Title | Apache Tomcat Improper Certificate Revocation Check Vulnerability |
Affected third-party component | Apache Tomcat |
Severity | Medium |
CVSS | 6.5 (CVSS v3.1) — AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Affected versions (upstream) | Apache Tomcat 8.5.0–8.5.100, 9.0.0.M1–9.0.121, 10.1.0-M1–10.1.59, 11.0.0-M1–11.0.25. Fixed in 11.0.26, 10.1.60, and 9.0.122. |
What the vulnerability is
Apache Tomcat's OpenSSL and OpenSSL-FFM based TLS implementations fail to properly check Certificate Revocation Lists (CRLs) when the server certificate is loaded from a Java keystore rather than a PEM file. In the keystore code path, the CRL is never passed to the native OpenSSL context, so the revocation check configured by an administrator is silently ignored. The connector starts normally, with no error raised.
Why you should pay attention
A client presenting a certificate that was legitimately issued but has since been revoked can still complete the TLS handshake. Tomcat then treats that client as authenticated wherever the connection relies on the client certificate, including CLIENT-CERT authentication, security realms, and application logic that trusts the certificate. This matters most for deployments that use mutual TLS or client-certificate authentication with keystore-based certificates and depend on revocation to lock out compromised or decommissioned credentials.
WinMagic product assessment
SecureDoc Client, SES Console, and SESWeb
SecureDoc does not include, install or depend on Apache Tomcat. SESWeb is hosted on Microsoft IIS.
Conclusion: SecureDoc Client, the SES Console and SESWeb are not affected by CVE-2026-73581.
Remediation
No WinMagic product-specific remediation, software update, patch, or configuration change is required in response to CVE-2026-73581. Organizations that run Apache Tomcat elsewhere in their own environment, outside of WinMagic products, should apply that vendor's own patch according to their standard process.
Ongoing monitoring
WinMagic continues to monitor relevant security advisories and available information concerning CVE-2026-73581. Should new information materially change this assessment, WinMagic will review its potential impact on SecureDoc Client, the SES Console or SESWeb and update this article accordingly.
Questions about this advisory
Customers with questions about this assessment can contact WinMagic Support through the usual support channel referencing KB-SEC-2026-1028-01.
WinMagic Corp.
winmagic.com