CVE-2026-34486

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

• CWE-311
• CWE-807

• https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrlyMailing List, Vendor Advisory
• https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcatThird Party Advisory
• https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcatMitigation, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:36787Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:36788Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:36789Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:36790Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:36876Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:36877Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:36878Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:36879Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:37136Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:37137Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:38505Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:39188Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:39189Third Party Advisory
• https://access.redhat.com/security/cve/CVE-2026-34486Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2457027Issue Tracking, Third Party Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.jsonThird Party Advisory
• https://socradar.io/blog/snowlight-government-chinese-campaign/Third Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486US Government Resource

Published

Apr 9, 2026

Last Modified

Aug 10, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34477The fix for CVE-2025-68161 https://logging.apache.org/secur…5.9
• CVE-2026-34478Apache Log4j Core's Rfc5424Layout https://logging.apache.or…7.5
• CVE-2026-34479The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridg…7.5
• CVE-2026-34480Apache Log4j Core's XmlLayout https://logging.apache.org/lo…7.5
• CVE-2026-34481Apache Log4j's JsonTemplateLayout https://logging.apache.or…7.5
• CVE-2026-34483Improper Encoding or Escaping of Output vulnerability in the…7.5
• CVE-2026-34487Insertion of Sensitive Information into Log File vulnerabili…7.5
• CVE-2026-34488IP Setting Software contains an issue with the DLL search pa…7.3
• CVE-2026-3449Versions of the package @tootallnate/once before 3.0.1 are v…3.3
• CVE-2026-34490Cleartext storage of sensitive information vulnerability in …5.5
• CVE-2026-34495Improper neutralization of input during web page generation …5.4
• CVE-2026-34496Cwe-269 vulnerability in Johnson Controls victor Web on Wind…7.1