CVE-2026-34486: Apache Tomcat EncryptInterceptor Bypass (KEV)

Checked: 2026-10-29

CVE-2026-34486 is a missing-encryption-of-sensitive-data flaw in Apache Tomcat where an incomplete fix for the earlier CVE-2026-29146 left the EncryptInterceptor — the component meant to encrypt cluster/channel traffic — bypassable, and both CISA's KEV catalog and FIRST's EPSS model (99.92nd percentile) treat it as a high-priority, actively exploited issue that can be chained with the well-known CVE-2025-24813 Tomcat RCE.

Vulnerability summary

Vulnerability ID	CVE-2026-34486
CVSS score	7.5
EPSS score	0.98503
CISA KEV	Yes — in the Known Exploited Vulnerabilities catalog
Source	CISA-ADP / Red Hat Secondary scores only, not NVD Primary
Published	2026-04-09T20:16:25.063

Affected components

Component	CPE	Version range
Apache Tomcat	cpe:2.3:a:apache:tomcat::::::::	9.0.116 (fixed in 9.0.117); 10.1.53 (fixed in 10.1.54); 11.0.20 (fixed in 11.0.21). Downstream Red Hat JBoss Web Server and several Red Hat Enterprise Linux channels also shipped fixes for the same CVE.

What this means

CVE-2026-34486 is a Missing Encryption of Sensitive Data (CWE-311) vulnerability, with NVD also recording a secondary Reliance on Untrusted Inputs in a Security Decision (CWE-807) weakness. NVD's description states: "Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue" (NVD).

NVD has not published its own independent Primary CVSS score for this record despite the vulnerability status being "Analyzed." Two Secondary submissions agree at CVSS v3.1 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — one from CISA-ADP and one from Red Hat's own security team (redhat-SADP) — network-reachable, low complexity, no privileges or user interaction required, high confidentiality impact only. Because neither is an NVD Primary metric, the 7.5 figure is labelled not NVD-confirmed on this page, even though two independent scorers agree on it (NVD).

Apache's own security advisory pages for the 9.0.x, 10.1.x and 11.0.x branches each confirm the same root cause in identical language: "An error in the fix for CVE-2026-29146 allowed the EncryptInterceptor to be bypassed," listing the issue as reported to the Tomcat security team on 26 March 2026 and made public on 9 April 2026, fixed by distinct commits on each branch (11.0.21, 10.1.54, 9.0.117) (Apache Tomcat 11 Security Advisories, Apache Tomcat 10 Security Advisories, Apache Tomcat 9 Security Advisories).

CISA added CVE-2026-34486 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-04, due date 2026-08-07, and its short description explicitly states "this vulnerability can be chained with CVE‑2025‑24813" — the widely exploited 2025 Tomcat partial-PUT path-equivalence RCE — meaning an attacker could potentially combine the two to both achieve remote code execution and evade the channel-encryption protection meant to limit lateral movement. Known ransomware campaign use is recorded as "Unknown" and forensic triage is not separately required. Catalog version 2026.10.28, 1,762 entries, confirmed live this run (CISA KEV).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.98503 (99.920th percentile) — among the highest EPSS scores on this site, consistent with a widely deployed application-server component under active, KEV-confirmed exploitation (FIRST EPSS).

Any Apache Tomcat 9.0.x, 10.1.x or 11.0.x deployment on the affected point releases should be upgraded to 9.0.117, 10.1.54 or 11.0.21 (or later) immediately, with particular attention to instances also exposed to CVE-2025-24813, since CISA explicitly flags the two as chainable.

How to fix this class of issueThis advisory does not name a weakness class we have a dedicated guide for yet. The fix is usually the vendor patch or firmware update referenced above — our guide below covers how to plan and verify that: NIST SP 800-40 Rev. 4: enterprise patch management planning, explained.

Evidence

Missing encryption of sensitive data in Apache Tomcat, caused by an incomplete fix for CVE-2026-29146, allowing the EncryptInterceptor to be bypassed; affects Tomcat 11.0.20, 10.1.53 and 9.0.116, fixed in 11.0.21, 10.1.54 and 9.0.117. — NVD
CVSS v3.1 score is 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, from two agreeing Secondary submissions (CISA-ADP and Red Hat); no NVD Primary metric is published. — NVD
Apache's own per-branch security pages confirm the EncryptInterceptor bypass was reported 26 March 2026 and made public 9 April 2026, with branch-specific fixing commits for 9.0.117, 10.1.54 and 11.0.21. — Apache Tomcat Security Advisories
Added to the CISA KEV catalog on 2026-08-04, due date 2026-08-07, explicitly noted as chainable with CVE-2025-24813, ransomware use Unknown. Catalog version 2026.10.28, 1,762 entries, confirmed live this run. — CISA KEV
EPSS score is 0.98503 (99.920th percentile) as of 2026-10-28. — FIRST EPSS

More advisories

CVE-2015-5287: Red Hat ABRT Coredump Symlink Privilege EscalationCVE-2015-5287: KEV symlink-attack privilege escalation in Red Hat's Automatic Bug Reporting Tool (ABRT) lets a local attacker gain root via a predictable coredump path. NVD-confirmed 7.8, sourced to NVD, CISA and Red Hat.CVE-2021-23758: Ajax.NET Professional (AjaxPro) Deserialization RCECVE-2021-23758: KEV deserialization-of-untrusted-data flaw in the end-of-life Ajax.NET Professional (AjaxPro) .NET library allows remote code execution. NVD-confirmed 9.8, sourced to NVD, CISA and the project's own fix commit.CVE-2023-4346: KNX Connection Authorization Account-Lockout DoSCVE-2023-4346: KEV overly restrictive account-lockout flaw in the KNX Connection Authorization Option 1 protocol used by building-automation devices, letting an attacker permanently brick a device. Sourced to NVD, CISA ICS-CERT and FIRST EPSS.