CVE-2026-34486 — HIGH (7.5)

Vulnerability Description

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Apache	Tomcat	9.0.116
Redhat	Jboss Web Server	7.0.0
Redhat	Enterprise Linux	8.0
Redhat	Enterprise Linux Els	7.0
Redhat	Enterprise Linux Eus	10.0
Redhat	Enterprise Linux Tus	8.8
Redhat	Enterprise Linux Update Services For Sap Solutions	8.8

Related Weaknesses (CWE)

CWE-807 CWE-311

References

https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrlyMailing ListVendor Advisory
https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apThird Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-aMitigationThird Party Advisory
https://access.redhat.com/errata/RHSA-2026:36787Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:36788Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:36789Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:36790Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:36876Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:36877Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:36878Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:36879Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:37136Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:37137Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:38505Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:39188Third Party Advisory

FAQ

What is CVE-2026-34486?

CVE-2026-34486 is a vulnerability with a CVSS score of 7.5 (HIGH). Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53...

How severe is CVE-2026-34486?

CVE-2026-34486 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-34486?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Tomcat, Redhat Jboss Web Server, Redhat Enterprise Linux, Redhat Enterprise Linux Els, Redhat Enterprise Linux Eus.