CVE-2026-34486

As of 2026-08-05, CVE-2026-34486 is a CVSS 7.5 (HIGH-severity) vulnerability. CISA KEV-listed (known exploited); Public exploit code available; Nuclei detection template exists. EPSS exploitation probability 42.6%. Threadlinqs Intelligence tracks 1 threat exploiting it.

Last updated: 2026-08-05

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-311, CWE-807

Exploitation status

CISA KEV-listed (known exploited) · public exploit code available · nuclei detection template exists

• anonmrc/CVE-2026-34486-e-Tomcat-Tribes (github)
• razureink/cve-2026-34486-tomcat_encrypt_bypass_reproduction (github)
• trickest/cve (trickest)

Affected packages

• maven:org.apache.tomcat:tomcat — patched in 11.0.21
• maven:org.apache.tomcat:tomcat — patched in 10.1.54
• maven:org.apache.tomcat:tomcat — patched in 9.0.117
• maven:org.apache.tomcat:tomcat-tribes — patched in 11.0.21
• maven:org.apache.tomcat:tomcat-tribes — patched in 10.1.54
• maven:org.apache.tomcat:tomcat-tribes — patched in 9.0.117

Threats tracking this CVE

• CVE-2026-34486: Apache Tomcat EncryptInterceptor Bypass Actively Exploited in SnowLight and AI-Assisted Campaigns — HIGH

References

• https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly

← all vulnerabilities · Markdown version · Threadlinqs Intelligence

Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.