CVE-2026-34486
KEVApache Tomcat Missing Encryption of Sensitive Data Vulnerability
Description
Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NPublishedApr 9, 2026
Last modifiedOct 26, 2026
Added to KEVAug 4, 2026
Remediation dueAug 7, 2026
References
- lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrlyMailing ListVendor Advisory
- vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcatThird Party Advisory
- vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcatMitigationThird Party Advisory
- access.redhat.com/errata/RHSA-2026:36787Third Party Advisory
- access.redhat.com/errata/RHSA-2026:36788Third Party Advisory
- access.redhat.com/errata/RHSA-2026:36789Third Party Advisory
- access.redhat.com/errata/RHSA-2026:36790Third Party Advisory
- access.redhat.com/errata/RHSA-2026:36876Third Party Advisory
- access.redhat.com/errata/RHSA-2026:36877Third Party Advisory
- access.redhat.com/errata/RHSA-2026:36878Third Party Advisory
- access.redhat.com/errata/RHSA-2026:36879Third Party Advisory
- access.redhat.com/errata/RHSA-2026:37136Third Party Advisory
0 recent articles mention this CVE
77
Risk assessment · High
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 81 days
- CVSS
- 7.5 HIGH
- EPSS (30-day exploit probability)
- 98.5% · top 1% of all CVEs
- Weakness
- CWE-311
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.