CVE-2026-34486 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-04-09

Added to CISA KEV: 2026-08-04 117 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
CRITICAL: This vulnerability is in the CISA KEV catalog indicating active exploitation in the wild. Immediately review Tombes/cluster logs, inspect for anomalous cluster messages, unexpected deserialization activity, unauthorized processes/webshells, and verify integrity of all clustered Tomcat nodes.
PATCH IMMEDIATELY: Upgrade to Apache Tomcat 11.0.21, 10.1.54, or 9.0.117 (or apply vendor-specific fixes: Red Hat RHSA-2026:36787/36879/39188/39189 etc.). This is an emergency-priority patch given KEV status.
Restrict access to the Tomcat Tribes cluster communication ports (default TCP 4000, multicast 45564) to a dedicated, isolated management/cluster VLAN. Ensure these ports are NEVER reachable from the internet or untrusted segments; apply firewall/ACL controls.
If clustering with EncryptInterceptor is not required, disable the cluster configuration as a compensating control until patched.
Monitor for exploitation indicators including malformed cluster messages, Java deserialization gadget-chain signatures, and outbound connections from Tomcat nodes; hunt for post-exploitation persistence (webshells, JSP backdoors).
Patch priority: CRITICAL / EMERGENCY — federal BOD 22-01 remediation timelines apply for KEV-listed vulnerabilities.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-34486 is a critical vulnerability affecting the Apache Tomcat Tribes cluster communication module, specifically within the `EncryptInterceptor` component. The vulnerability was inadvertently introduced as a regression during the remediation of a previous security issue, CVE-2026-29146. It occurs because the module fails to properly discard messages when decryption fails, allowing attackers to bypass the intended encryption and authentication mechanisms. This vulnerability is significant because it can lead to remote code execution (RCE) via Java deserialization attacks, posing a severe threat to the integrity and security of the affected server.

Exploitation

Active Exploitation: The vulnerability has been confirmed as being exploited in the wild and was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog in August 2026 ^[2]^[3].
Proof-of-Concept/Exploit Tool Availability: Publicly available information suggests that exploit methodologies targeting the failure to discard messages in the Tribes cluster module are circulating ^[1].
Attack Prerequisites:

* Network Access: The attack is typically directed at the port used for cluster communication (e.g., port 4000) ^[1]. * Authentication: Successful exploitation does not require prior authentication from the attacker ^[1]. * User Interaction: No user interaction is required for a successful attack.

Affected Products & Patches

Affected Versions: Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116 ^[4]^[5].
Patch Availability: The Apache Software Foundation has released patches for this issue. Users are strongly recommended to upgrade to the following versions:

* Apache Tomcat 11.0.21 * Apache Tomcat 10.1.54 * Apache Tomcat 9.0.117 ^[4]^[5].

Impact

Access/Capability: Successful exploitation provides an attacker with the ability to trigger remote code execution (RCE) on the affected Tomcat instance by leveraging malicious Java deserialization payloads ^[1].
Business Risk: For internet-facing deployments, this vulnerability presents a critical risk, as it allows unauthenticated remote attackers to gain full control over the affected server, potentially leading to total system compromise, data theft, and unauthorized persistence within the network.

Sources

CVE-2026-34486 — Apache Tomcat EncryptInterceptor RCE
Apache Tomcat Tribes cluster communication module fails to discard messages when EncryptInterceptor decryption fails, allowing unauthenticated attackers to ... CVE-2026-34486 — Apache Tomcat EncryptInterceptor RCE Apache Tomcat Tribes cluster communication module fails to discard messages when Encry…
CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data ...
CVE-2026-34486 affects Apache · Tomcat. Exploited in the wild (CISA KEV). Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for… Severity, affected software, exploitation status, patch guidance and references.
CISA Adds Three Known Exploited Vulnerabilities to Catalog
CVE-2026-9198 IBM Langflow Code Injection Vulnerability; CVE-2026 ... CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data ...
NVD-CVE-2026-34486 - NIST
Description. Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of ... CVE-2026-34486 Detail Description Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of…
CVE-2026-34486 - Vulnerability Details - OpenCVE
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the iss…

🔴 CVE-2026-34486