57
U.S. CISA adds Microsoft .NET Framework, Apache OFBiz, and Paessler PRTG Network Monitor flaws to its Known Exploited Vulnerabilities catalog
60
47
CVE-2026-34486: Apache Tomcat Auth Bypass Vulnerability
SentinelOne details CVE-2026-34486, an Apache Tomcat EncryptInterceptor bypass exposing unencrypted cluster communications, with patches and workarounds available.
CVE-2026-34486 stems from an incomplete fix for CVE-2026-29146, letting network-positioned attackers bypass the EncryptInterceptor and read plaintext Tomcat cluster traffic, including session and application data between nodes. Affected versions 9.0.116, 10.1.53 and 11.0.20 are fixed in 9.0.117, 10.1.54 and 11.0.21. Workarounds include network-level encryption such as IPsec or VPN tunnels and isolating cluster communications to secured network segments.
45
57
57
42
42
57
42
57
42
57
47
57
57
42
57
57
42
42
42
57
42
57
42
57
42
57
57
42
47
57
42
42
57
42
57
42
42