+1Hello,
Can someone tell me what impact the following Apache Tomcat vulnerability has on FME Flow 2026.2 build 26333?
CVE-2026-76183
https://lists.apache.org/thread.html/45mxk8nj2q8pkhct6lfxkvtm2jpywrsp
Is it also possible to update only Apache Tomcat, or does the entire application need to be upgraded?
Thank you in advance.
Best answer by todd_davis
I would send Safe support this query.
2026.2 uses Tomcat 10.1.55, so it is using a vulnerable version, but that doesn’t mean that FME Flow is vulnerable
You can also upgrade Tomcat independently: https://support.safe.com/hc/en-us/articles/25407527726221-FME-Flow-Upgrade-Provide-Your-Own-Version-of-Tomcat
But I do have a question around whether you are using websockets and what authentications means you are using against that endpoint? I didn’t think websockets in FME Flow had this type of authentication??
+23I would send Safe support this query.
2026.2 uses Tomcat 10.1.55, so it is using a vulnerable version, but that doesn’t mean that FME Flow is vulnerable
You can also upgrade Tomcat independently: https://support.safe.com/hc/en-us/articles/25407527726221-FME-Flow-Upgrade-Provide-Your-Own-Version-of-Tomcat
But I do have a question around whether you are using websockets and what authentications means you are using against that endpoint? I didn’t think websockets in FME Flow had this type of authentication??
+12Jumping in here to second Todd’s suggestion. Always send any CVE questions to support if you can’t find any clear info.
As far as this exact situation, Flow is shipped with the CVE, but no components rely on it.
Flow is not vulnerable to CVE-2026-76183.
+1I would send Safe support this query.
2026.2 uses Tomcat 10.1.55, so it is using a vulnerable version, but that doesn’t mean that FME Flow is vulnerable
You can also upgrade Tomcat independently: https://support.safe.com/hc/en-us/articles/25407527726221-FME-Flow-Upgrade-Provide-Your-Own-Version-of-Tomcat
But I do have a question around whether you are using websockets and what authentications means you are using against that endpoint? I didn’t think websockets in FME Flow had this type of authentication??
We are not using WebSockets, and I am not familiar with the type of authentication that is configured for them. I was alerted to this vulnerability by one of our system administrators. To take the concern seriously, I decided to raise the question in the community.
I suspect that the impact on FME Flow is quite limited. This is especially true because our FME Flow environment is hosted internally.
