CVE-2026-34486
Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
Description
CVE-2026-34486 is a missing-encryption-of-sensitive-data vulnerability in Apache Tomcat that allows an unauthenticated, remote attacker to bypass the EncryptInterceptor and expose confidential cluster traffic. The flaw was introduced by the fix for CVE-2026-29146 and affects Tomcat 11.0.20, 10.1.53, and 9.0.116, as well as several downstream Red Hat products that ship Tomcat. Because the EncryptInterceptor can be bypassed, data that administrators expect to be encrypted between clustered Tomcat nodes may be transmitted in a way that is readable to an attacker with network access, undermining the confidentiality of session replication and other cluster communications. With a CVSS score of 7.5, an exceptionally high EPSS score of about 83% (99th percentile), and inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog, CVE-2026-34486 is an actively exploited Apache Tomcat vulnerability that requires prompt patching.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apache | tomcat | 9.0.116; 10.1.53; 11.0.20 |
| redhat | jboss web server | 7.0.0 |
| redhat | enterprise linux | 8.0; 9.0; 10.0 |
| redhat | enterprise linux els | 7.0 |
| redhat | enterprise linux eus | 10.0 |
| redhat | enterprise linux tus | 8.8 |
| redhat | enterprise linux update services for sap solutions | 8.8; 9.2; 9.4; 9.6 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly(Mailing List, Vendor Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat(Mitigation, Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2026:36787(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2026:36788(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2026:36789(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2026:36790(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2026:36876(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2026:36877(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2026:36878(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2026:36879(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2026:37136(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2026:37137(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2026:38505(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2026:39188(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2026:39189(Third Party Advisory)
- https://access.redhat.com/security/cve/CVE-2026-34486(Third Party Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=2457027(Issue Tracking, Third Party Advisory)
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json(Third Party Advisory)
- https://socradar.io/blog/snowlight-government-chinese-campaign/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486(US Government Resource)
Weakness Type
CWE-311: Missing Encryption of Sensitive Data
This weakness occurs when software fails to encrypt sensitive information before storage or transmission, exposing it to anyone who can intercept the traffic. In CVE-2026-34486, the EncryptInterceptor — the mechanism intended to encrypt Apache Tomcat cluster communications — can be bypassed, so sensitive cluster data may be transmitted without the expected encryption.
Learn more: CWE-311 — Missing Encryption of Sensitive Data
CWE-807: Reliance on Untrusted Inputs in a Security Decision
This weakness occurs when software bases a security-critical decision on inputs that an untrusted actor can modify. In the context of CVE-2026-34486, the bypass of the EncryptInterceptor reflects a security decision that can be subverted, allowing the encryption control to be circumvented rather than reliably enforced.
Learn more: CWE-807 — Reliance on Untrusted Inputs in a Security Decision
Impact Analysis
The impact of CVE-2026-34486 is focused on data confidentiality: the attack vector is network-based, making it remotely exploitable without physical access, and with attack complexity low it is easy to exploit without special conditions. Privileges required is none and user interaction is none, so no authentication and no victim action are needed. The vulnerability results in high confidentiality impact while integrity and availability are unaffected, meaning an attacker can read sensitive information — such as replicated session data flowing between Tomcat cluster nodes — that should have been protected by encryption. Rated CVSS 7.5 (High), the vulnerability is especially concerning because its EPSS score of roughly 83% sits in the 99th percentile, indicating a very high likelihood of active exploitation, a conclusion reinforced by its presence in the CISA KEV catalog.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-34486 by adding it to the Known Exploited Vulnerabilities catalog, so organizations running affected Apache Tomcat versions should treat this as an in-the-wild threat. The EPSS score of approximately 83% (99th percentile) is among the highest observed and points to a very high probability of ongoing exploitation activity. The referenced third-party advisories from Vicarius include both detection and mitigation scripts for CVE-2026-34486, indicating that tooling to identify and address the issue is publicly available, and the extensive Red Hat errata reflect broad vendor response. The KEV ransomware flag is currently "Unknown," but the combination of an easily reachable, unauthenticated confidentiality flaw and a near-top EPSS ranking makes immediate remediation essential.
Remediation
- Apply the Apache Tomcat update immediately. Per CISA's KEV required action, follow the vendor's instructions in line with BOD 26-04 patching guidance, and discontinue use of the product if mitigations are unavailable.
- Upgrade to a fixed Tomcat version. Users of Tomcat 11.0.20 should upgrade to 11.0.21, users of 10.1.53 to 10.1.54, and users of 9.0.116 to 9.0.117, which correct the EncryptInterceptor bypass.
- Patch affected downstream distributions. For Red Hat products that ship Tomcat — including JBoss Web Server and various Red Hat Enterprise Linux streams (8, 9, 10, ELS, EUS, TUS, and Update Services for SAP Solutions) — apply the corresponding errata (RHSA-2026:36787 through RHSA-2026:36878).
- Protect cluster traffic at the network layer as an interim measure, isolating Tomcat cluster communication on a trusted, segmented network so that unencrypted replication traffic cannot be intercepted by untrusted hosts until patches are deployed.
- Verify encryption is enforced after patching by confirming that the EncryptInterceptor is active and correctly configured, and, in line with CWE-311 guidance, ensure sensitive data in transit is protected with strong, current transport encryption.
Technical Details
CVE-2026-34486 arises because the fix for CVE-2026-29146 introduced a flaw that allows the EncryptInterceptor in Apache Tomcat to be bypassed, resulting in missing encryption of sensitive data (CWE-311) combined with a security decision that can be subverted through untrusted inputs (CWE-807). The EncryptInterceptor is responsible for encrypting communication between clustered Tomcat nodes; when it can be bypassed, sensitive cluster data — including replicated session information — may traverse the network without the confidentiality protection administrators rely on. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N confirms the flaw is network-reachable with low complexity and no authentication or user interaction, with impact limited to confidentiality; the two mapped weaknesses relate in that the missing encryption (CWE-311) is the exposed condition while the bypassable enforcement of that encryption reflects reliance on untrusted inputs in a security decision (CWE-807).
Frequently Asked Questions
Is CVE-2026-34486 being actively exploited?
Yes. CISA has added CVE-2026-34486 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Its EPSS score of about 83% (99th percentile) is exceptionally high, indicating a very strong likelihood of ongoing exploitation.
What products are affected by CVE-2026-34486?
The vulnerability affects Apache Tomcat 11.0.20, 10.1.53, and 9.0.116, along with downstream distributions such as Red Hat JBoss Web Server and multiple Red Hat Enterprise Linux streams (including ELS, EUS, TUS, and Update Services for SAP Solutions) that ship Tomcat.
How do I fix CVE-2026-34486?
Upgrade Apache Tomcat to 11.0.21, 10.1.54, or 9.0.117 depending on your branch, and apply the corresponding Red Hat errata for downstream products, following CISA's KEV guidance under BOD 26-04. As an interim measure, isolate cluster traffic on a trusted, segmented network.
How severe is CVE-2026-34486?
It is rated High with a CVSS 3.1 base score of 7.5. Although the impact is limited to confidentiality, the vulnerability is unauthenticated, network-exploitable, and low-complexity, and its EPSS score in the 99th percentile makes it a high-priority patch.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.