What’s Vulnerable › Vulnerabilities
CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2026-08-04
- EPSS: 98.5% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-04-09 · updated 2026-10-26
- Weakness: CWE-311
Description
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
Affected products
- Apache Tomcat: 9.0.116, 10.1.53, 11.0.20
- Red Hat Enterprise Linux: 8.0, 9.0, 10.0
- RedHat Enterprise Linux Els: 7.0
- RedHat Enterprise Linux Eus: 10.0
- RedHat Enterprise Linux Tus: 8.8
- RedHat Enterprise Linux Update Services For Sap Solutions: 8.8, 9.2, 9.4, 9.6
- RedHat Jboss Web Server: 7.0.0
References
- https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly
- https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat
- https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat
- https://access.redhat.com/errata/RHSA-2026:36787
- https://access.redhat.com/errata/RHSA-2026:36788
- https://access.redhat.com/errata/RHSA-2026:36789
- https://access.redhat.com/errata/RHSA-2026:36790
- https://access.redhat.com/errata/RHSA-2026:36876
- https://access.redhat.com/errata/RHSA-2026:36877
- https://access.redhat.com/errata/RHSA-2026:36878
- https://access.redhat.com/errata/RHSA-2026:36879
- https://access.redhat.com/errata/RHSA-2026:37136
Get alerted when CVE-2026-34486 or the next vulnerability affects your stack