Apache Tomcat
CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
What it is
Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.
What to do
Schedule the vendor fix into this week’s change window, prioritising internet-facing and business-critical systems. Confirm the fix is applied everywhere, not just where it was easy.
- Priority
- This week: Schedule into this week’s change window.
- Severity (CVSS)
- 7.5 high
- CISA assessment (SSVC)
- actively exploited; attackers can automate it at scale; partial control or data exposure
- Exploit probability (EPSS, 30 days)
- 6.6%, higher than 93% of all CVEs
- Added to CISA KEV
- 4 August 2026
- CISA fix-by date
- 7 August 2026 (US federal agencies; a sensible deadline for everyone)
- Ransomware use
- Not known
- Weakness
- CWE-311, CWE-807
References
- NIST NVD entry
- CISA KEV entry
- lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly
- www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tom
- www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-to
- access.redhat.com/errata/RHSA-2026:36787
- access.redhat.com/errata/RHSA-2026:36788
- access.redhat.com/errata/RHSA-2026:36789
Sources: CISA Known Exploited Vulnerabilities · FIRST Exploit Prediction Scoring System (EPSS) · NIST National Vulnerability Database · CISA Vulnrichment (SSVC), via the CVE Program. This product uses data from the NVD API but is not endorsed or certified by the NVD. Summaries are machine-written from CISA’s description; treat the vendor’s advisory as the authority for fixes.