diff --git a/DSE_6.8_Release_Notes.md b/DSE_6.8_Release_Notes.md
index ae3359e..fd3c2fe 100644
--- a/DSE_6.8_Release_Notes.md
+++ b/DSE_6.8_Release_Notes.md
@@ -41,6 +41,7 @@ If you're developing applications, please refer to the [Java Driver documentatio
 ## 6.8.66 DSE CVE
 * Upgraded okio to version 1.17.6. (DSP-25277, [CVE-2023-3635](https://nvd.nist.gov/vuln/detail/CVE-2023-3635))
 * Upgraded Apache Tomcat to version 9.0.120. (DSP-25226, [CVE-2026-59083](https://nvd.nist.gov/vuln/detail/CVE-2026-59083), [CVE-2026-59084](https://nvd.nist.gov/vuln/detail/CVE-2026-59084))
+* **Security notice**: Apache Tomcat 9.0.120 (shipped with DSE 6.8.66) is affected by multiple CVEs that require an upgrade to version 9.0.122 or higher. A fix is being tracked in DSP-25319. Affected CVEs: [CVE-2026-73581](https://nvd.nist.gov/vuln/detail/CVE-2026-73581), [CVE-2026-75973](https://nvd.nist.gov/vuln/detail/CVE-2026-75973), [CVE-2026-77756](https://nvd.nist.gov/vuln/detail/CVE-2026-77756), [CVE-2026-77762](https://nvd.nist.gov/vuln/detail/CVE-2026-77762), [CVE-2026-78383](https://nvd.nist.gov/vuln/detail/CVE-2026-78383), [CVE-2026-78437](https://nvd.nist.gov/vuln/detail/CVE-2026-78437), [CVE-2026-86350](https://nvd.nist.gov/vuln/detail/CVE-2026-86350)
 * Upgraded jQuery to version 3.5.1 in Apache Spark Core. (DSP-25227, [CVE-2020-11022](https://nvd.nist.gov/vuln/detail/CVE-2020-11022))
 * Upgraded Jackson FasterXML to version 2.18.9. (DSP-25228, [CVE-2026-59888](https://nvd.nist.gov/vuln/detail/CVE-2026-59888), [CVE-2026-77310](https://nvd.nist.gov/vuln/detail/CVE-2026-77310), [CVE-2026-54512](https://nvd.nist.gov/vuln/detail/CVE-2026-54512), [CVE-2026-54513](https://nvd.nist.gov/vuln/detail/CVE-2026-54513), [CVE-2026-54514](https://nvd.nist.gov/vuln/detail/CVE-2026-54514), [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515), [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889))
 * Upgraded Netty to version 4.1.137.Final. (DSP-25260, [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901), [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745), [CVE-2026-56822](https://nvd.nist.gov/vuln/detail/CVE-2026-56822), [CVE-2026-56821](https://nvd.nist.gov/vuln/detail/CVE-2026-56821), [CVE-2026-56820](https://nvd.nist.gov/vuln/detail/CVE-2026-56820), [CVE-2026-56817](https://nvd.nist.gov/vuln/detail/CVE-2026-56817), [CVE-2026-55851](https://nvd.nist.gov/vuln/detail/CVE-2026-55851), [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921), [CVE-2026-59920](https://nvd.nist.gov/vuln/detail/CVE-2026-59920), [CVE-2026-59919](https://nvd.nist.gov/vuln/detail/CVE-2026-59919), [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900), [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899), [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898), [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819), [CVE-2026-56818](https://nvd.nist.gov/vuln/detail/CVE-2026-56818), [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746))