CVE-2026-34486 Apache Tomcat
| Affected software | Apache Tomcat |
|---|---|
| Severity | 7.5 High CVSS 3.1 2 scores |
| Fixed in | 11.0.21, 10.1.54, 9.0.117 |
| Weakness | CWE-311 |
| Published | 9 Apr 2026 |
| Updated | 26 Oct 2026 |
Description
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
CWE-807
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2026-08-04 · remediation due 2026-08-07 · ransomware use: unknown
- VulnCheck KEV listed Exploitation reported in the wild. 9 citations · 2 exploits · earliest 2026-07-30.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: partial.
- Indexed PoC 6 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2026-04-15.
- EPSS 99% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2026-34486 in VulnCheck (free account), which lists 4 more citations not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Reported exploitation | unit42.paloaltonetworks.com | /autonomous-ai-cyber-attack-campaign | 2026-07-30 |
| Reported exploitation | socradar.io | /blog/snowlight-government-chinese-campaign | 2026-07-31 |
| Reported exploitation | previdian.com | /CVE-2026-34486 | 2026-08-04 |
| Reported exploitation | cisa.gov | /sites/default/files/feeds/known_exploited_vulnerabilities.json | 2026-08-04 |
| Reported exploitation | hkcert.org | /security-bulletin/apache-tomcat-multiple-vulnerabilities_20260805 | 2026-08-05 |
| Exploit reference | VulnCheck XDB afb09f0ad770 | Exploit type: initial-access | 2026-05-11 |
| Exploit reference | VulnCheck XDB 41dfeadea72e | Exploit type: initial-access | 2026-08-19 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | EncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization. | 70 | 2026-05-11 |
| GitHub PoC | CVE-2026-34486 Apache Tomcat EncryptInterceptor 绕过漏洞复现（使用GLM5.1复现完成） | 12 | 2026-04-15 |
| GitHub PoC | Apache Tomcat EncryptInterceptor Bypass → Unauthenticated RCE (CVE-2026-34486) | 10 | 2026-04-15 |
| GitHub PoC | EncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization. | 2026-08-19 | |
| GitHub PoC | CVE Reproduction: cve-2026-34486-tomcat_encrypt_bypass_reproduction | 2026-07-23 | |
| Nuclei | Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Deserialization, Process
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the Marshal RCE rule, ARMR Process rule. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: Marshal RCE rule, ARMR Process rule
Plaintext Tribes messages still reach ObjectInputStream.readObject() in XByteBuffer.deserialize after EncryptInterceptor fails to decrypt them; Marshal deserialize(java)+rce() blocks the gadget chain, and the Process rule (with /bin/* and /usr/* listed) stops the shell fork. Injected ordinary session data (such as a forged logged-in session) is not stopped.
How to mitigate CVE-2026-34486
Upgrade Apache Tomcat to a release that fixes it: 11.0.21, 10.1.54 or 9.0.117. Until you can, Waratek RASP blocks exploitation with its deserialization and process rules. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
7.5 HIGH
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2 metrics
CVSS
7.5 HIGH v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
CISA-ADP | Secondary | published |
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
redhat-SADP | Secondary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update October 2026 ↗ | CPU | 2026-Q4 | Oracle Communications / Security (Apache Tomcat) (47.0.0.2.0) |
| Oracle Critical Patch Update July 2026 ↗ | CPU | 2026-Q3 | Oracle Commerce / Content Acquisition System (Apache Tomcat) (11.4.0) Oracle Communications / Alarms, KPI, and Measurements (Apache Tomcat) (25.2.200) Oracle Communications / Configuration Management Platform (Apache Tomcat) (15.0.0.0) Oracle Communications / Core (Apache Tomcat) (6.1.1-7.0.0) Oracle Communications / Security (Apache Tomcat) (25.2.0.0.0) Oracle Retail Applications / Xenvironment (Apache Tomcat) (21.0.5-25.0.1) Oracle Siebel CRM / EAI (Apache Tomcat) (17.0-26.5) Oracle Supply Chain / Folders, Files & Attachments (Apache Tomcat) (9.3.6) |
| Oracle Critical Security Patch Update May 2026 ↗ | CSPU | 2026-Q2 | Oracle Communications / Core (Apache Tomcat) (6.1.1-7.0.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Commerce | Content Acquisition System (Apache Tomcat) | 11.4.0 | 11.4.0 |
| Oracle Communications | Alarms, KPI, and Measurements (Apache Tomcat) | 25.2.200 | 25.2.200 |
| Oracle Communications | Configuration Management Platform (Apache Tomcat) | 15.0.0.0 | 15.0.0.0 |
| Oracle Communications | Core (Apache Tomcat) | 6.1.1-7.0.0 | |
| Oracle Communications | Security (Apache Tomcat) | 25.2.0.0.0 | 25.2.0.0.0 · 47.0.0.2.0 |
| Oracle Retail Applications | Xenvironment (Apache Tomcat) | 21.0.5-25.0.1 | |
| Oracle Siebel CRM | EAI (Apache Tomcat) | 17.0-26.5 | |
| Oracle Supply Chain | Folders, Files & Attachments (Apache Tomcat) | 9.3.6 | 9.3.6 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.tomcat:tomcat-tribes |
11.0.20 | 11.0.21 |
unbounded |
org.apache.tomcat:tomcat-tribes |
10.1.53 | 10.1.54 |
unbounded |
org.apache.tomcat:tomcat-tribes |
9.0.116 | 9.0.117 |
unbounded |
org.apache.tomcat:tomcat |
11.0.20 | 11.0.21 |
unbounded |
org.apache.tomcat:tomcat |
10.1.53 | 10.1.54 |
unbounded |
org.apache.tomcat:tomcat |
9.0.116 | 9.0.117 |
unbounded |
Products and versions
9 products, 20 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | tomcat | generic | 9.0.116 · 10.1.53 · 11.0.20 |
| osv | org.apache.tomcat | tomcat | generic | ≥ 9.0.116 and ＜ 9.0.117 · ≥ 10.1.53 and ＜ 10.1.54 · ≥ 11.0.20 and ＜ 11.0.21 |
| osv | org.apache.tomcat | tomcat-tribes | generic | ≥ 9.0.116 and ＜ 9.0.117 · ≥ 10.1.53 and ＜ 10.1.54 · ≥ 11.0.20 and ＜ 11.0.21 |
| nvd | redhat | enterprise linux | generic | 8.0 · 9.0 · 10.0 |
| nvd | redhat | enterprise linux els | generic | 7.0 |
| nvd | redhat | enterprise linux eus | generic | 10.0 |
| nvd | redhat | enterprise linux tus | generic | 8.8 |
| nvd | redhat | enterprise linux update services for sap solutions | generic | 8.8 · 9.2 · 9.4 · 9.6 |
| nvd | redhat | jboss web server | generic | 7.0.0 |
References
Timeline
Timeline
| Published | 2026-04-09 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2026-07-30 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| Added to CISA KEV | 2026-08-04 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| VulnCheck KEV: latest evidence | 2026-09-08 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| Last VRT activity | 2026-09-29 | Most recent commit touching this CVE's classification, patch or rule file. |
| NVD record modified | 2026-10-26 | NVD's own last-modified date for this record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |