CVE-2026-34486 KEVPublic exploit High · 7.5 EPSS 98.5%

Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

Apache · Tomcat

Official description · NVD

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Breakdown

73.2 / 100

Exploited: Yes, in CISA KEV
Reports: 0
Tactics: 3/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Capture network trafficT1040 · Network SniffingAI-written (claude-haiku-5-5)Medium confidence9 general detection rules
What they do
- Intercept network trafficT1557 · Adversary-in-the-MiddleAI-written (claude-haiku-5-5)Medium confidence10 general detection rules

First seen exploited 4 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 6 days after disclosure.

Disclosed9 Apr 2026day 0
Public exploit codePoC-in-GitHub15 Apr 2026+6 days
First seen exploitedVulnCheck KEV evidence30 Jul 2026+4 mo
Added to CISA KEVEU database agrees4 Aug 2026+4 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

See the family tree

A fix was bypassed or incomplete once on the same day.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2026-29146Tomcat: EncryptInterceptor vulnerable to padding oracle attack…9 Apr 2026
bypassed the fixHigh
Why these are linked:
- Stated in the CVE textMissing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.
- Fixed one release later9.0.116 → 9.0.117 (org.apache.tomcat:tomcat-tribes)
- Fixed one release later10.1.53 → 10.1.54 (org.apache.tomcat:tomcat-tribes)
- Similar weakness in the same product (machine-matched)same product + description similarity
This CVECVE-2026-34486Tomcat Missing Encryption of Sensitive Data9 Apr 2026KEV

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Credential AccessTA0006

Network Sniffing T1040 Medium also Discovery

AI mapping from the description · how it is exploited

Bypass enables network traffic interception and sniffing

allowing the bypass of the EncryptInterceptor

From the official description (NVD) Original ↗

Adversary-in-the-Middle T1557 Medium also Collection

AI mapping from the description · primary impact

Unencrypted cluster traffic is interceptable by adversaries

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat

From the official description (NVD) Original ↗

Detection

0 rules for this CVE · 19 general rules for its techniques

Rules for this CVE

0 that reference CVE-2026-34486 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Network SniffingT10409 general rules

Cisco Sniffingmediumtest
Harvesting Of Wifi Credentials Via Netsh.EXEmediumtest
New Network Trace Capture Started Via Netsh.EXEmediumtest
PktMon.EXE Executionmediumtest
Potential Network Sniffing Activity Using Network Toolsmediumtest
Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlockmediumtest
Windows Pcap Driversmediumtest
Network Sniffing - Linuxlowtest

All 9 on SigmaHQ ↗

Adversary-in-the-MiddleT155710 general rules

Suspicious Child Process of Notepad++ Updater - GUP.Exehighexperimental
Uncommon File Created by Notepad++ Updater Gup.EXEhighexperimental
Potential Suspicious Activity Using SeCEditmediumtest
ISATAP Router Address Was Setmediumexperimental
Notepad++ Updater DNS Query to Uncommon Domainsmediumexperimental
Cisco BGP Authentication Failureslowtest
Cisco LDP Authentication Failureslowtest
Huawei BGP Authentication Failureslowtest

All 10 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

2 packages in 1 ecosystem. Main package: org.apache.tomcat:tomcat.

Mavenorg.apache.tomcat:tomcatGHSA-69r9-qgr7-g2wj

Upgrade to 11.0.21 or later

Set the version to 11.0.21 or later in your pom.xml or build.gradle.

The first fix for CVE-2026-34486.

Affected versions, by release line

If you run	Upgrade to
11.0.20 up to 11.0.21	11.0.21
10.1.53 up to 10.1.54	10.1.54
9.0.116 up to 9.0.117	9.0.117

“Up to” means the second version is the fix and is not affected.

Other packages that bundle this code (1)

Forks, repackagings and products that include the affected code. Each has its own fixed version.

Mavenorg.apache.tomcat:tomcat-tribes
Affected: 11.0.20 up to 11.0.21; 10.1.53 up to 10.1.54; 9.0.116 up to 9.0.117Upgrade to 11.0.21 or later (older lines: 10.1.54, 9.0.117)
GHSA-69r9-qgr7-g2wj

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 31, 202630 Oct 2026
Actively_Exploited_Kev | Oct 30, 202629 Oct 2026
Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
44 more on OTX

References

21 links, grouped by NVD tag

Show 11 moreShow fewer

access.redhat.com/errata/RHSA-2026:36878 access.redhat.com/errata/RHSA-2026:36879 access.redhat.com/errata/RHSA-2026:37136 access.redhat.com/errata/RHSA-2026:37137 access.redhat.com/errata/RHSA-2026:38505 access.redhat.com/errata/RHSA-2026:39188 access.redhat.com/errata/RHSA-2026:39189 access.redhat.com/security/cve/CVE-2026-34486 bugzilla.redhat.com/show_bug.cgi?id=2457027 security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json socradar.io/blog/snowlight-government-chinese-campaign/

Exploitation evidence

Exploited in the wild

Listed since 4 Aug 2026. Federal due date 7 Aug 2026. No recorded ransomware use.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

ENISA

Marked exploited since 4 Aug 2026. EUVD-2026-21056

Public exploitAdvisories link exploit code.

, 30 Oct 2026

98.5%Top 0.08%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.92%).

3.1

7.5High · 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 93 days ago 5.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9992 20.0/20

Threat reports0 reports 0.0/10

Public exploit code5 PoC-in-GitHub repos; 1 nuclei template 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 7.5 5.3/7

End-of-life productsupported or unknown 0.0

Total73.2

Record

Published: 9 Apr 2026
Modified: 26 Oct 2026
: CWE-311 Missing Encryption of Sensitive DataCWE-807 Reliance on Untrusted Inputs in a Security Decision
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Credential AccessTA0006

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 1

US Government Resource 1

Third Party Advisory 19

How attackers get in

What they do

techniques