CVE-2026-34486: Apache Tomcat EncryptInterceptor bypass exposes sensitive data

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe flaw is in CISA KEV with a near-maximum EPSS score and allows unauthenticated network attackers to obtain sensitive data, so it warrants immediate patching.

What it is

Apache Tomcat contains a missing encryption of sensitive data flaw: the fix for CVE-2026-29146 can be bypassed, allowing the EncryptInterceptor to be circumvented. This matters because data that operators expect to be encrypted in transit may be transmitted in the clear. Affected versions are 11.0.20, 10.1.53 and 9.0.116; fixes are in 11.0.21, 10.1.54 and 9.0.117.

Impact

An attacker who can observe or intercept the affected traffic gains access to sensitive data that the EncryptInterceptor was meant to protect, resulting in confidentiality loss. The CVSS vector shows no integrity or availability impact.

Attack surface

Reachable over the network with no authentication and no user interaction (AV:N/AC:L/PR:N/UI:N). The flaw sits in the Tomcat clustering/EncryptInterceptor path, so exposure depends on deployments that rely on that interceptor for encryption.

Exploitation

CVE-2026-34486 is listed in CISA KEV with a due date of 2026-08-07, and EPSS is 0.98616 (99.9th percentile), indicating observed exploitation activity. No ransomware campaign use is documented in the record.

What to do

• Upgrade Apache Tomcat to 11.0.21, 10.1.54 or 9.0.117 as directed by the vendor advisory.
• Apply the Red Hat errata (RHSA-2026:36787 through RHSA-2026:39189) for affected JBoss Web Server and Enterprise Linux packages.
• Follow CISA BOD 26-04 guidance, including evaluating internet exposure of each Tomcat asset and applying the required action by the KEV due date.
• If patching cannot be completed immediately, discontinue use of the affected component or isolate the clustering traffic until the fix is applied.
• Verify that EncryptInterceptor is actually enforcing encryption after upgrade rather than assuming the configuration is effective.

Detection

• Monitor for anomalous or cleartext traffic on Tomcat cluster/interceptor ports that should be encrypted.
• Review Tomcat and JBoss Web Server versions in inventory against the fixed releases 11.0.21, 10.1.54 and 9.0.117.
• Hunt for signs of interception or credential/data capture on segments carrying Tomcat cluster traffic.
• Track KEV and vendor advisory updates for this CVE and confirm remediation status of exposed instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.