sign in--:--:--UTC

CVE-2020-1938

exploited in the wild☆ pin

CVSS

9.8

Reports

4

First seen

Feb 24, 2020

Last seen

Oct 13, 2026

Affected product

Apache Tomcat 6.x, 7.0.99 and below, 8.5.50 and below, 9.0.30 and below

Associated actors

NightEagle ×1 Red Heron ×1 ShinyHunters ×1 Suspected Chinese-speaking threat actor ×1 Suspected Russian-speaking threat actor ×1 UAT-11823 ×1 UAT-11988 ×1 UAT-12197 ×1 UNC3569 ×1

Recent reports

September 2026 CVE Landscape: 94 High-Impact Vulnerabilities with Active Exploitation

Recorded Future InsiktOct 13, 2026 High

Multiple Vulnerabilities in Apache Struts 2.0.0 to 2.5.20

GovCERT.HKAug 14, 2020 High

Vulnerability in Apache Tomcat (CVE-2020-1938)

GovCERT.HKJun 29, 2020 Critical

High Threat Security Alert: Vulnerability in Apache Tomcat AJP

GovCERT.HKFeb 24, 2020

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign up See plans