CVEs / CVE-2026-34486

CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

Known exploited in the CISA KEV catalog since 4 Aug 2026
high 7.5 CVSS 3.1 (from the CNA)
EPSS 98.5% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
Last changed at its sources 28 Oct 2026

Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.

Check your servers with Stackurity Already using Stackurity? Search for CVE-2026-34486

Summary

Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.
CISA, Known Exploited Vulnerabilities catalog

Description

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
The CVE record, via NVD · published 9 Apr 2026 · NVD status: Analyzed

Affected and fixed versions

As stated by the CVE record (from the CNA)
Product	Affected	Fixed in
Apache Software Foundation Apache Tomcat	11.0.20	—
Apache Software Foundation Apache Tomcat	10.1.53	—
Apache Software Foundation Apache Tomcat	9.0.116	—

As stated by OSV
Product	Affected	Fixed in
org.apache.tomcat:tomcat-tribes (Maven)	from 11.0.20, before 11.0.21	11.0.21
org.apache.tomcat:tomcat-tribes (Maven)	from 10.1.53, before 10.1.54	10.1.54
org.apache.tomcat:tomcat-tribes (Maven)	from 9.0.116, before 9.0.117	9.0.117
org.apache.tomcat:tomcat (Maven)	from 11.0.20, before 11.0.21	11.0.21
org.apache.tomcat:tomcat (Maven)	from 10.1.53, before 10.1.54	10.1.54
org.apache.tomcat:tomcat (Maven)	from 9.0.116, before 9.0.117	9.0.117

Package versions from GHSA-69r9-qgr7-g2wj.

Exploitation

In CISA KEV since	4 Aug 2026
Due date for US federal agencies	7 Aug 2026
Used in ransomware campaigns	Unknown
Required action	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Severity

CVSS 3.1	7.5 high `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` Scored by the CNA (134c704f-9b21-4f2e-91b3-4a467353bcc0)
Weakness	CWE-311, CWE-807

References

CVE-2026-34486 on NVD
CVE-2026-34486 in the CISA KEV catalog
https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly (cited by CISA)
https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk (cited by CISA)
https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk (cited by CISA)
CVE-2026-34486 on OSV
https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly Mailing List, Vendor Advisory
https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat Third Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat Mitigation, Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:36787 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:36788 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:36789 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:36790 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:36876 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:36877 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:36878 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:36879 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:37136 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:37137 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:38505 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:39188 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:39189 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-34486 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2457027 Issue Tracking, Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json Third Party Advisory
https://socradar.io/blog/snowlight-government-chinese-campaign/ Third Party Advisory

Sources

Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.

This product uses data from the NVD API but is not endorsed or certified by the NVD.