CVE-2026-34486: Apache Software Foundation Apache Tomcat
Found by web discovery while looking for coverage of CVE-2026-34486
CISA added CVE-2026-34486, an actively exploited Apache Tomcat EncryptInterceptor bypass enabling unauthenticated deserialization RCE, to its KEV catalog.
CVE-2026-34486 allows bypass of Apache Tomcat's EncryptInterceptor, a flaw introduced by the fix for padding-oracle issue CVE-2026-29146 in Tribes cluster encryption. CISA added the flaw to the Known Exploited Vulnerability catalog on August 4, 2026, alongside actively exploited Langflow and N-central flaws, with remediation required under BOD 26-04 guidance. Official patches and workarounds are available, and reporting notes unauthenticated remote code execution through Java deserialization on the Tribes receiver port 4000.
- Added to CISA KEV on August 4, 2026; exploitation is actively observed.
- Fail-open regression from the CVE-2026-29146 fix exposes cluster traffic.
- CISA's required action references BOD 26-04 mitigation guidance.
- Reported alongside actively exploited Langflow and N-central vulnerabilities.
- Vendors
- Apache Software Foundation
- Products
- Apache TomcatLangflowN-central
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-34486+1 related CVE | EncryptInterceptor Bypass Exposes Cluster Traffic in Apache Tomcat | 7.5 | 99% | KEV | KEV |
From the original article
2 min read at cve.tools
CVE-2026-34486 is a serious Apache Tomcat flaw that lets an attacker skip the app’s “encrypt this data” rule and view sensitive information without needing a login; most small businesses running affected Tomcat versions should act immediately.
By Pavel Buchnev · cve.tools
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.