CVE-2026-34486

high

Description

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

References

https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat

https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat

https://socradar.io/blog/snowlight-government-chinese-campaign/

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json

https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly

https://bugzilla.redhat.com/show_bug.cgi?id=2457027

https://access.redhat.com/security/cve/CVE-2026-34486

https://access.redhat.com/errata/RHSA-2026:39189

https://access.redhat.com/errata/RHSA-2026:39188

https://access.redhat.com/errata/RHSA-2026:38505

https://access.redhat.com/errata/RHSA-2026:37137

https://access.redhat.com/errata/RHSA-2026:37136

https://access.redhat.com/errata/RHSA-2026:36879

https://access.redhat.com/errata/RHSA-2026:36878

https://access.redhat.com/errata/RHSA-2026:36877

https://access.redhat.com/errata/RHSA-2026:36876

https://access.redhat.com/errata/RHSA-2026:36790

https://access.redhat.com/errata/RHSA-2026:36789

https://access.redhat.com/errata/RHSA-2026:36788

https://access.redhat.com/errata/RHSA-2026:36787

https://www.securityweek.com/cisa-warns-of-exploited-langflow-n-central-and-tomcat-vulnerabilities/

https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-langflow-n-central-apache-tomcat-flaws/

https://thehackernews.com/2026/08/cisa-flags-langflow-rce-tomcat-and-n.html

https://securityaffairs.com/196667/hacking/u-s-cisa-adds-langflow-apache-tomcat-and-n-able-n-central-flaws-to-its-known-exploited-vulnerabilities-catalog.html

https://www.cisa.gov/news-events/alerts/2026/08/04/cisa-adds-three-known-exploited-vulnerabilities-catalog

https://www.infosecurity-magazine.com/news/chinese-hacker-deepseek-ai/

https://www.tenable.com/blog/the-agentic-ai-threat-cluster-seven-incidents-three-actors-and-what-they-mean

https://github.com/CypherHippie/CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization

https://github.com/BlAck9D/Curator

https://github.com/razureink/cve-2026-34486-tomcat_encrypt_bypass_reproduction

https://github.com/1392081456/sigma-detection-rules

https://github.com/helGayhub233/CVE-2026-34486-Tribes

https://github.com/404-src/CVE-2026-34486

https://github.com/AirSkye/CVE-2026-34486-poc

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486

Details

Source: Mitre, NVD

Published: 2026-04-09

Updated: 2026-08-10

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Severity: High

EPSS

EPSS: 0.98616