Tomcat Manager Malicious WAR Deployment

Ethan Andrews@eandrews

•updated Feb 18, 2026•6•0•72

Detects suspicious web requests to the Tomcat Manager on Dell RecoverPoint appliances. This technique is used by UNC6201 to exploit CVE-2026-22769 and upload malicious WAR files.