CVE-2026-34486highunder attackCWE-311CWE-807

CVE-2026-34486: high-severity vulnerability in Apache Tomcat

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

Published · Updated

Follow this CVE+ Monitor Apache Tomcat+ Monitor org.apache.tomcat:tomcat

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a working public exploit.

ssvc Actcvss 7.5epss 99%
from disclosure to weapon32 days
Published on NVDApr 9
1st PoC+32d
CISA KEV+117d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CISC Gov.br · 11 Aug 2026Boletim do CISC de Vulnerabilidaderead on gov.br ↗
  • CTIR Gov · ALERTA 67/2026 · 05 Aug 2026Vulnerabilidade crítica que afeta o Tomcatread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
2 products (14 components)
Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 9
workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Fixed
15 products (150 components)
Red Hat Enterprise Linux AppStream (v. 10) · Red Hat Enterprise Linux AppStream EUS (v. 10.0) · Red Hat JBoss Web Server 7.0 on RHEL 10 · Red Hat JBoss Web Server 7.0 on RHEL 8 · Red Hat JBoss Web Server 7.0 on RHEL 9 · and others 10
fix ↗
Not affected
6 products (62 components) — because the vulnerable code is not present in the product
Red Hat JBoss Web Server 7.0 on RHEL 10 · Red Hat JBoss Web Server 7.0 on RHEL 8 · Red Hat JBoss Web Server 7.0 on RHEL 9 · Red Hat Enterprise Linux 8 · Red Hat JBoss Web Server 5 · and others 1
Action required by CISAfederal deadline: 2026-08-07

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

Apache Tomcat has a flaw where sensitive data encryption can be bypassed due to an incomplete fix. This means attackers could intercept and read private information that should have been protected.

Technical detail

CVE-2026-34486 involves a bypass of the EncryptInterceptor mechanism in Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116. The vulnerability stems from an insufficient fix to CVE-2026-29146, allowing attackers to circumvent encryption protections for sensitive data in transit. Exploitation requires network-level access to intercepted communications, with impact ranging from confidentiality breach of encrypted payloads.

Summary generated and translated by AI from the official description.
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Apache Software Foundation · Apache Tomcat
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache Tomcat

In the same product, most dangerous first.

CVE-2017-12617HIGHCVE-2017-12617EPSS 100.0%KEVCVE-2025-24813CRITICALApache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTEPSS 99.9%KEVCVE-2017-12615HIGHCVE-2017-12615EPSS 99.7%KEVCVE-2016-8735CRITICALCVE-2016-8735EPSS 90.3%KEVCVE-2018-11784—CVE-2018-11784EPSS 97.7%CVE-2021-33037—Incorrect Transfer-Encoding handling with HTTP/1.0EPSS 74.7%