CVE-2026-34486
Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 7 August 2026). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 98.50% probability · 100th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Listed 4 August 2026 · due 7 August 2026
- Weakness
- CWE-311, CWE-807
- Affected
- apache/tomcat · redhat/jboss web server · redhat/enterprise linux · redhat/enterprise linux els · redhat/enterprise linux eus · redhat/enterprise linux tus · redhat/enterprise linux update services for sap solutions
- Source
- security@apache.org
EPSS moved from 6.6% on 24 September 2026 to 98.5% on 30 October 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.
CISA notes
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-34486
References
- https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrlyMailing List, Vendor Advisory
- https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcatThird Party Advisory
- https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcatMitigation, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36787Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36788Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36789Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36790Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36876Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36877Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36878Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36879Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:37136Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:37137Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:38505Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:39188Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:39189Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-34486Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2457027Issue Tracking, Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.jsonThird Party Advisory
- https://socradar.io/blog/snowlight-government-chinese-campaign/Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.