Vulnerability Details CVE-2026-34486
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.
This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.
Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.829
EPSS Ranking 99.6%
CVSS Severity
CVSS v3 Score 7.5
Proposed Action
Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.
Ransomware Campaign
Unknown
References
- https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly
- https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat
- https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat
- https://access.redhat.com/errata/RHSA-2026:36787
- https://access.redhat.com/errata/RHSA-2026:36788
- https://access.redhat.com/errata/RHSA-2026:36789
- https://access.redhat.com/errata/RHSA-2026:36790
- https://access.redhat.com/errata/RHSA-2026:36876
- https://access.redhat.com/errata/RHSA-2026:36877
- https://access.redhat.com/errata/RHSA-2026:36878
- https://access.redhat.com/errata/RHSA-2026:36879
- https://access.redhat.com/errata/RHSA-2026:37136
- https://access.redhat.com/errata/RHSA-2026:37137
- https://access.redhat.com/errata/RHSA-2026:38505
- https://access.redhat.com/errata/RHSA-2026:39188
- https://access.redhat.com/errata/RHSA-2026:39189
- https://access.redhat.com/security/cve/CVE-2026-34486
- https://bugzilla.redhat.com/show_bug.cgi?id=2457027
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json
- https://socradar.io/blog/snowlight-government-chinese-campaign/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486
Products affected by CVE-2026-34486
-
cpe:2.3:a:apache:tomcat:10.1.53
-
cpe:2.3:a:apache:tomcat:11.0.20
-
cpe:2.3:a:apache:tomcat:9.0.116
-
cpe:2.3:a:redhat:jboss_web_server:7.0.0
-
cpe:2.3:o:redhat:enterprise_linux:10.0
-
cpe:2.3:o:redhat:enterprise_linux:8.0
-
cpe:2.3:o:redhat:enterprise_linux:9.0
-
cpe:2.3:o:redhat:enterprise_linux_els:7.0
-
cpe:2.3:o:redhat:enterprise_linux_eus:10.0
-
cpe:2.3:o:redhat:enterprise_linux_tus:8.8
-
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8
-
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2
-
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.4
-
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.6