MSRXCVE-2026-34486
CVE-2026-34486
Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVSS 3.1 · CNA
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
Scores
Affected packages and fixed versions
| Package | Ecosystem | Fixed in |
|---|---|---|
| org.apache.tomcat:tomcat-tribes | Maven | 11.0.21, 10.1.54, 9.0.117 |
| org.apache.tomcat:tomcat | Maven | 11.0.21, 10.1.54, 9.0.117 |
Affected products
- apache tomcat: 9.0.116; 10.1.53; 11.0.20
- redhat jboss web server: 7.0.0
- redhat enterprise linux: 8.0; 9.0; 10.0
- redhat enterprise linux els: 7.0
- redhat enterprise linux eus: 10.0
- redhat enterprise linux tus: 8.8
- redhat enterprise linux update services for sap solutions: 8.8; 9.2; 9.4; 9.6
Also known as: BIT-tomcat-2026-34486, GHSA-69r9-qgr7-g2wj
21 references (advisories, patches, write-ups)
- https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly · Mailing List, Vendor Advisory
- https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat · Third Party Advisory
- https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat · Mitigation, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36787 · Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36788 · Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36789 · Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36790 · Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36876 · Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36877 · Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36878 · Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36879 · Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:37136 · Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:37137 · Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:38505 · Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:39188 · Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:39189 · Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-34486 · Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2457027 · Issue Tracking, Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json · Third Party Advisory
- https://socradar.io/blog/snowlight-government-chinese-campaign/ · Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486 · US Government Resource
Sources: NVD, CVE.org, OSV.dev, FIRST EPSS. Missing ones did not answer or have no record yet.